ffs: avoid undefined behavior