[bacescuandrei]

bextr clamps LEN to the operand-size bound (63 or 31) and builds the mask as (1 << LEN) - 1, so a length at or above the operand size drops the top bit of the result:

bextr rax, rbx, rcx   rbx = 0x8000000000000000, rcx = 0x4000 (start 0, len 64)
  unicorn: rax = 0                  hardware / SDM: rax = 0x8000000000000000
bextr eax, ebx, ecx   ebx = 0x80000000, ecx = 0x2000 (start 0, len 32)
  unicorn: eax = 0                  hardware / SDM: eax = 0x80000000

The Intel SDM defines the result as the LEN bits starting at START, with all remaining bits of the operand kept when LEN reaches past it. This change builds an inverse mask -1 << LEN that is cleared for lengths above the bound, which is how QEMU's current gen_BEXTR (target/i386/tcg/emit.c.inc) does it. Lengths below the operand size are unchanged.

Test: test_x86_bextr_len in tests/unit/test_x86.c covers lengths 64 and 255, length 63, start 63 with length 1, and the 32-bit form with length 32. Without the change the length-64, length-255 and 32-bit cases fail; with it the test and the rest of test_x86 pass (x86-only Debug build, Linux x86_64).