From PR #711, which has been closed:
The issue is that MSVC for 32-bit targets implements 64x64->64 bit multiplications using a non-constant subroutine. The subroutine is not constant-time because it shortcuts when the high 32 bits of both multiplicands are all 0. See research.kudelskisecurity.com/2017/01/16/when-constant-time-source-may-not-save-you and also bearssl.org/ctmul.html for a broader view of the issue.
I’m opening this GitHub issue here because the underlying issue hasn’t been solved. (And I’ve checked the compiler explorer, the issue is still present on the latest msvc…)
After #1000 and #1156, this is (much?) less severe because we now support 64-bit targets on MSVC, and MSVC produces proper constant-time muls for those targets, it just outputs imul.
The best solution is probably #815.