bn_sub_words_borrow
BN_ULONG bn_sub_words_borrow(const BN_ULONG *a, const BN_ULONG *b, size_t n);
mask = ~(carry - bn_sub_words_borrow(r, m, n));