pub proof fn lemma_u16_and_zero(x: u16)
0u16 & x == 0u16,
AND-ing the zero word with any word is zero.