This code (Intel syntax, constrained by gas 2.42 limitations)
mov esi, 0x11
lea rdi, [rip+out]
mov r16d, 0x16161616
mov r17d, 0x17171717
mov r18d, 0x18181818
sub esi, 0x11
mov [rdi], r16
# cfcmovz [rdi], r17
.byte 0x62, 0xe4, 0xfc, 0x0c, 0x44, 0x0f # BUG: no effect
dec esi
# cfcmovz [rdi], r18
.byte 0x62, 0xe4, 0xfc, 0x0c, 0x44, 0x17 # correctly no effect
mov rax, [rdi]
is, aiui, supposed to be leaving rax with 0x17171717. But the observation is that it's left as 0x16161616, i.e. neither of the two CFCMOVZ taking any effect (when only the 2nd one shouldn't). Of course, due to the need to encode the insn with .byte, I can't exclude I made a mistake there; it looks to be in line with what the APX doc says, though (ND=0 NF=1 encoding the memory destination form of the insn).
