pub proof fn lemma_u16_log2_bounds(x: u16)
0 <= log(2, x as int) <= u16::BITS,
0 <= x.ilog2() <= u16::BITS,