You can&#x27;t store a 4096-bit number in 32-bit register, so if you are multiplying numbers together you need to do it a piece (limb) at a time. Given that the arithmetic is modular, you can get away with &quot;leaving some room&quot; and not using all 32-bits, but instead using more 32-bit registers and treating them as if they are say 26-bit registers that can overflow 6-bits. For instance, Curve25519 (255-bit modulus) can be stored with 8 32-bit limbs, or 10 26-bit limbs (among other combinations). So if you do repeated calculations, you don&#x27;t need to carry all of the bits all of the time. I don&#x27;t know if it&#x27;s the case for this bug, but I know it&#x27;s been a bug in the past that they waited too long to propagate the carry (the extra 6-bits) into the next limb and it&#x27;s overflowed the 32-bit register. This results in an incorrect calculation.