Fix #1462, #1480.
diff --git a/passes/pmgen/xilinx_dsp.pmg b/passes/pmgen/xilinx_dsp.pmg
index 604aa22..0ba5290 100644
--- a/passes/pmgen/xilinx_dsp.pmg
+++ b/passes/pmgen/xilinx_dsp.pmg
@@ -98,16 +98,16 @@
 	if (param(dsp, \USE_MULT, Const("MULTIPLY")).decode_string() == "MULTIPLY") {
 		// Only care about those bits that are used
 		int i;
-		for (i = 0; i < GetSize(P); i++) {
-			if (nusers(P[i]) <= 1)
+		for (i = GetSize(P)-1; i >= 0; i--)
+			if (nusers(P[i]) > 1)
 				break;
-			sigM.append(P[i]);
-		}
+		i++;
 		log_assert(nusers(P.extract_end(i)) <= 1);
 		// This sigM could have no users if downstream sinks (e.g. $add) is
 		//   narrower than $mul result, for example
-		if (sigM.empty())
+		if (i == 0)
 			reject;
+		sigM = P.extract(0, i);
 	}
 	else
 		sigM = P;
@@ -460,6 +460,8 @@
 
 code
 	dff = nullptr;
+	if (GetSize(argQ) == 0)
+		reject;
 	for (const auto &c : argQ.chunks()) {
 		// Abandon matches when 'Q' is a constant
 		if (!c.wire)
diff --git a/passes/pmgen/xilinx_dsp_CREG.pmg b/passes/pmgen/xilinx_dsp_CREG.pmg
index a570430..5cd3416 100644
--- a/passes/pmgen/xilinx_dsp_CREG.pmg
+++ b/passes/pmgen/xilinx_dsp_CREG.pmg
@@ -63,12 +63,12 @@
 	if (param(dsp, \USE_MULT, Const("MULTIPLY")).decode_string() == "MULTIPLY") {
 		// Only care about those bits that are used
 		int i;
-		for (i = 0; i < GetSize(P); i++) {
-			if (nusers(P[i]) <= 1)
+		for (i = GetSize(P)-1; i >= 0; i--)
+			if (nusers(P[i]) > 1)
 				break;
-			sigP.append(P[i]);
-		}
+		i++;
 		log_assert(nusers(P.extract_end(i)) <= 1);
+		sigP = P.extract(0, i);
 	}
 	else
 		sigP = P;
diff --git a/tests/various/bug1462.ys b/tests/various/bug1462.ys
new file mode 100644
index 0000000..15cab51
--- /dev/null
+++ b/tests/various/bug1462.ys
@@ -0,0 +1,11 @@
+read_verilog << EOF
+module top(...);
+input wire [31:0] A;
+output wire [31:0] P;
+
+assign P = A * 32'h12300000;
+
+endmodule
+EOF
+
+synth_xilinx
diff --git a/tests/various/bug1480.ys b/tests/various/bug1480.ys
new file mode 100644
index 0000000..84faea0
--- /dev/null
+++ b/tests/various/bug1480.ys
@@ -0,0 +1,18 @@
+read_verilog << EOF
+module top(...);
+
+input signed [17:0] A;
+input signed [17:0] B;
+output X;
+output Y;
+
+wire [35:0] P;
+assign P = A * B;
+
+assign X = P[0];
+assign Y = P[35];
+
+endmodule
+EOF
+
+synth_xilinx