; LLVM IR from thalium/icebox :: third_party/virtualbox/src/VBox/Devices/EFI/Firmware/NetworkPkg/IpSecDxe (IpSecEspInboundPacket)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.NET_BUF = type { i32, i64, %struct._LIST_ENTRY, %union.NET_IP_HEAD, ptr, ptr, [64 x i8], ptr, i32, i32, [1 x %struct.NET_BLOCK_OP] }
%struct._LIST_ENTRY = type { ptr, ptr }
%union.NET_IP_HEAD = type { ptr }
%struct.NET_BLOCK_OP = type { ptr, ptr, ptr, ptr, i32 }
%struct._EFI_ESP_HEADER = type { i32, i32 }
%struct._IPSEC_SAD_ENTRY = type { ptr, ptr, %struct._LIST_ENTRY, %struct._LIST_ENTRY }
%struct._EFI_IPSEC_SA_ID = type { i32, i32, %union.EFI_IP_ADDRESS }
%union.EFI_IP_ADDRESS = type { [4 x i32] }
%struct._IPSEC_SAD_DATA = type { i32, i64, i8, [4 x i64], %union.EFI_IPSEC_ALGO_INFO, %struct._EFI_IPSEC_SA_LIFETIME, i32, ptr, ptr, i8, i8, %union.EFI_IP_ADDRESS, %union.EFI_IP_ADDRESS }
%union.EFI_IPSEC_ALGO_INFO = type { %struct._EFI_IPSEC_ESP_ALGO_INFO }
%struct._EFI_IPSEC_ESP_ALGO_INFO = type { i8, i64, ptr, i8, i64, ptr }
%struct._EFI_IPSEC_SA_LIFETIME = type { i64, i64, i64 }
%struct._EFI_ESP_TAIL = type { i8, i8 }
%struct.EFI_BOOT_SERVICES = type { %struct.EFI_TABLE_HEADER, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr }
%struct.EFI_TABLE_HEADER = type { i64, i32, i32, i32, i32 }
%struct._IPSEC_RECYCLE_CONTEXT = type { ptr, ptr }
%struct._EFI_IPSEC_FRAGMENT_DATA = type { i32, ptr }
%struct.IP4_HEAD = type { i8, i8, i16, i16, i16, i8, i8, i16, i32, i32 }
%struct._EFI_IP6_HEADER = type { i16, i16, i16, i8, i8, %struct.EFI_IPv6_ADDRESS, %struct.EFI_IPv6_ADDRESS }
%struct.EFI_IPv6_ADDRESS = type { [16 x i8] }

@gBS = external global ptr, align 8

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #0

declare zeroext i16 @SwapBytes16(i16 noundef zeroext) #1

; Function Attrs: nounwind uwtable
declare dso_local void @IpSecOnRecyclePacket(ptr noundef) #2

; Function Attrs: nounwind uwtable
declare dso_local void @IpSecRecycleCallback(ptr noundef, ptr noundef) #2

declare void @FreePool(ptr noundef) #1

; Function Attrs: nounwind uwtable
declare dso_local zeroext i16 @IpSecGetPlainExtHeadSize(ptr noundef, ptr noundef) #2

; Function Attrs: nounwind uwtable
declare dso_local i64 @IpSecEspAuthVerifyPayload(ptr noundef, i64 noundef, ptr noundef, i64 noundef) #2

; Function Attrs: nounwind uwtable
declare dso_local ptr @IpSecFoundSadFromInboundPacket(ptr noundef, i8 noundef zeroext, i32 noundef) #2

; Function Attrs: nounwind uwtable
declare dso_local void @IpSecTunnelInboundPacket(ptr noundef, ptr noundef, i8 noundef zeroext, ptr noundef, ptr noundef) #2

declare ptr @AllocateZeroPool(i64 noundef) #1

declare ptr @NetbufFromExt(ptr noundef, i32 noundef, i32 noundef, i32 noundef, ptr noundef, ptr noundef) #1

declare ptr @NetbufGetByte(ptr noundef, i32 noundef, ptr noundef) #1

declare void @NetbufFree(ptr noundef) #1

; Function Attrs: nounwind uwtable
define dso_local i64 @IpSecEspInboundPacket(i8 noundef zeroext %0, ptr noundef %1, ptr noundef %2, ptr noundef %3, ptr noundef %4, ptr noundef %5, ptr noundef %6, ptr noundef %7, ptr noundef %8) #2 {
  %10 = alloca i8, align 1
  %11 = alloca ptr, align 8
  %12 = alloca ptr, align 8
  %13 = alloca ptr, align 8
  %14 = alloca ptr, align 8
  %15 = alloca ptr, align 8
  %16 = alloca ptr, align 8
  %17 = alloca ptr, align 8
  %18 = alloca ptr, align 8
  %19 = alloca i64, align 8
  %20 = alloca ptr, align 8
  %21 = alloca i64, align 8
  %22 = alloca i64, align 8
  %23 = alloca i64, align 8
  %24 = alloca i64, align 8
  %25 = alloca i64, align 8
  %26 = alloca i64, align 8
  %27 = alloca i64, align 8
  %28 = alloca ptr, align 8
  %29 = alloca ptr, align 8
  %30 = alloca ptr, align 8
  %31 = alloca ptr, align 8
  %32 = alloca ptr, align 8
  %33 = alloca ptr, align 8
  %34 = alloca ptr, align 8
  %35 = alloca i8, align 1
  %36 = alloca i16, align 2
  %37 = alloca ptr, align 8
  store i8 %0, ptr %10, align 1, !tbaa !5
  store ptr %1, ptr %11, align 8, !tbaa !8
  store ptr %2, ptr %12, align 8, !tbaa !8
  store ptr %3, ptr %13, align 8, !tbaa !8
  store ptr %4, ptr %14, align 8, !tbaa !8
  store ptr %5, ptr %15, align 8, !tbaa !8
  store ptr %6, ptr %16, align 8, !tbaa !8
  store ptr %7, ptr %17, align 8, !tbaa !8
  store ptr %8, ptr %18, align 8, !tbaa !8
  call void @llvm.lifetime.start.p0(i64 8, ptr %19) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %20) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %21) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %22) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %23) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %24) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %25) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %26) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %27) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %28) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %29) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %30) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %31) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %32) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %33) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %34) #3
  call void @llvm.lifetime.start.p0(i64 1, ptr %35) #3
  call void @llvm.lifetime.start.p0(i64 2, ptr %36) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %37) #3
  store i64 0, ptr %19, align 8, !tbaa !10
  store ptr null, ptr %20, align 8, !tbaa !8
  store ptr null, ptr %28, align 8, !tbaa !8
  store ptr null, ptr %34, align 8, !tbaa !8
  %38 = load ptr, ptr %18, align 8, !tbaa !8
  store ptr null, ptr %38, align 8, !tbaa !8
  store i64 0, ptr %25, align 8, !tbaa !10
  store i8 0, ptr %35, align 1, !tbaa !5
  %39 = load ptr, ptr %15, align 8, !tbaa !8
  %40 = load ptr, ptr %39, align 8, !tbaa !8
  %41 = load ptr, ptr %16, align 8, !tbaa !8
  %42 = load i32, ptr %41, align 4, !tbaa !12
  %43 = call ptr @NetbufFromExt(ptr noundef %40, i32 noundef %42, i32 noundef 0, i32 noundef 8, ptr noundef @IpSecOnRecyclePacket, ptr noundef null)
  store ptr %43, ptr %20, align 8, !tbaa !8
  %44 = load ptr, ptr %20, align 8, !tbaa !8
  %45 = icmp eq ptr %44, null
  br i1 %45, label %46, label %47

46:                                               ; preds = %9
  store i64 -9223372036854775799, ptr %19, align 8, !tbaa !10
  br label %360

47:                                               ; preds = %9
  %48 = load ptr, ptr %20, align 8, !tbaa !8
  %49 = getelementptr inbounds %struct.NET_BUF, ptr %48, i32 0, i32 9
  %50 = load i32, ptr %49, align 4, !tbaa !14
  %51 = zext i32 %50 to i64
  store i64 %51, ptr %21, align 8, !tbaa !10
  %52 = load ptr, ptr %20, align 8, !tbaa !8
  %53 = call ptr @NetbufGetByte(ptr noundef %52, i32 noundef 0, ptr noundef null)
  store ptr %53, ptr %29, align 8, !tbaa !8
  %54 = load ptr, ptr %29, align 8, !tbaa !8
  %55 = icmp eq ptr %54, null
  br i1 %55, label %56, label %57

56:                                               ; preds = %47
  store i64 -9223372036854775793, ptr %19, align 8, !tbaa !10
  br label %360

57:                                               ; preds = %47
  %58 = load ptr, ptr %11, align 8, !tbaa !8
  %59 = load i8, ptr %10, align 1, !tbaa !5
  %60 = load ptr, ptr %29, align 8, !tbaa !8
  %61 = getelementptr inbounds %struct._EFI_ESP_HEADER, ptr %60, i32 0, i32 0
  %62 = load i32, ptr %61, align 1, !tbaa !17
  %63 = call i32 @SwapBytes32(i32 noundef %62)
  %64 = call ptr @IpSecFoundSadFromInboundPacket(ptr noundef %58, i8 noundef zeroext %59, i32 noundef %63)
  store ptr %64, ptr %33, align 8, !tbaa !8
  %65 = load ptr, ptr %33, align 8, !tbaa !8
  %66 = icmp eq ptr %65, null
  br i1 %66, label %67, label %68

67:                                               ; preds = %57
  store i64 -9223372036854775793, ptr %19, align 8, !tbaa !10
  br label %360

68:                                               ; preds = %57
  %69 = load ptr, ptr %33, align 8, !tbaa !8
  %70 = getelementptr inbounds %struct._IPSEC_SAD_ENTRY, ptr %69, i32 0, i32 0
  %71 = load ptr, ptr %70, align 8, !tbaa !19
  store ptr %71, ptr %31, align 8, !tbaa !8
  %72 = load ptr, ptr %33, align 8, !tbaa !8
  %73 = getelementptr inbounds %struct._IPSEC_SAD_ENTRY, ptr %72, i32 0, i32 1
  %74 = load ptr, ptr %73, align 8, !tbaa !21
  store ptr %74, ptr %32, align 8, !tbaa !8
  %75 = load ptr, ptr %31, align 8, !tbaa !8
  %76 = getelementptr inbounds %struct._EFI_IPSEC_SA_ID, ptr %75, i32 0, i32 1
  %77 = load i32, ptr %76, align 4, !tbaa !22
  %78 = icmp ne i32 %77, 1
  br i1 %78, label %79, label %80

79:                                               ; preds = %68
  store i64 -9223372036854775793, ptr %19, align 8, !tbaa !10
  br label %360

80:                                               ; preds = %68
  %81 = load ptr, ptr %32, align 8, !tbaa !8
  %82 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %81, i32 0, i32 10
  %83 = load i8, ptr %82, align 1, !tbaa !24
  %84 = icmp ne i8 %83, 0
  br i1 %84, label %86, label %85

85:                                               ; preds = %80
  br label %86

86:                                               ; preds = %85, %80
  %87 = load i64, ptr %21, align 8, !tbaa !10
  %88 = call ptr @AllocateZeroPool(i64 noundef %87)
  store ptr %88, ptr %28, align 8, !tbaa !8
  %89 = load ptr, ptr %28, align 8, !tbaa !8
  %90 = icmp eq ptr %89, null
  br i1 %90, label %91, label %92

91:                                               ; preds = %86
  store i64 -9223372036854775799, ptr %19, align 8, !tbaa !10
  br label %360

92:                                               ; preds = %86
  %93 = load ptr, ptr %20, align 8, !tbaa !8
  %94 = load i64, ptr %21, align 8, !tbaa !10
  %95 = trunc i64 %94 to i32
  %96 = load ptr, ptr %28, align 8, !tbaa !8
  %97 = call i32 @NetbufCopy(ptr noundef %93, i32 noundef 0, i32 noundef %95, ptr noundef %96)
  %98 = load ptr, ptr %33, align 8, !tbaa !8
  %99 = getelementptr inbounds %struct._IPSEC_SAD_ENTRY, ptr %98, i32 0, i32 1
  %100 = load ptr, ptr %99, align 8, !tbaa !21
  %101 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %100, i32 0, i32 4
  %102 = getelementptr inbounds %struct._EFI_IPSEC_ESP_ALGO_INFO, ptr %101, i32 0, i32 3
  %103 = load i8, ptr %102, align 8, !tbaa !5
  %104 = call i64 @IpSecGetIcvLength(i8 noundef zeroext %103)
  store i64 %104, ptr %27, align 8, !tbaa !10
  %105 = load ptr, ptr %33, align 8, !tbaa !8
  %106 = getelementptr inbounds %struct._IPSEC_SAD_ENTRY, ptr %105, i32 0, i32 1
  %107 = load ptr, ptr %106, align 8, !tbaa !21
  %108 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %107, i32 0, i32 4
  %109 = getelementptr inbounds %struct._EFI_IPSEC_ESP_ALGO_INFO, ptr %108, i32 0, i32 0
  %110 = load i8, ptr %109, align 8, !tbaa !5
  %111 = call i64 @IpSecGetEncryptIvLength(i8 noundef zeroext %110)
  store i64 %111, ptr %22, align 8, !tbaa !10
  %112 = load ptr, ptr %33, align 8, !tbaa !8
  %113 = getelementptr inbounds %struct._IPSEC_SAD_ENTRY, ptr %112, i32 0, i32 1
  %114 = load ptr, ptr %113, align 8, !tbaa !21
  %115 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %114, i32 0, i32 4
  %116 = getelementptr inbounds %struct._EFI_IPSEC_ESP_ALGO_INFO, ptr %115, i32 0, i32 0
  %117 = load i8, ptr %116, align 8, !tbaa !5
  %118 = call i64 @IpSecGetEncryptBlockSize(i8 noundef zeroext %117)
  store i64 %118, ptr %23, align 8, !tbaa !10
  %119 = load i64, ptr %22, align 8, !tbaa !10
  %120 = add i64 8, %119
  %121 = load i64, ptr %27, align 8, !tbaa !10
  %122 = add i64 %120, %121
  store i64 %122, ptr %24, align 8, !tbaa !10
  %123 = load i64, ptr %21, align 8, !tbaa !10
  %124 = load i64, ptr %24, align 8, !tbaa !10
  %125 = add i64 %124, 2
  %126 = icmp ule i64 %123, %125
  br i1 %126, label %127, label %128

127:                                              ; preds = %92
  store i64 -9223372036854775793, ptr %19, align 8, !tbaa !10
  br label %360

128:                                              ; preds = %92
  %129 = load i64, ptr %21, align 8, !tbaa !10
  %130 = load i64, ptr %24, align 8, !tbaa !10
  %131 = sub i64 %129, %130
  %132 = load i64, ptr %23, align 8, !tbaa !10
  %133 = urem i64 %131, %132
  %134 = icmp ne i64 %133, 0
  br i1 %134, label %135, label %136

135:                                              ; preds = %128
  store i64 -9223372036854775793, ptr %19, align 8, !tbaa !10
  br label %360

136:                                              ; preds = %128
  %137 = load ptr, ptr %32, align 8, !tbaa !8
  %138 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %137, i32 0, i32 4
  %139 = getelementptr inbounds %struct._EFI_IPSEC_ESP_ALGO_INFO, ptr %138, i32 0, i32 5
  %140 = load ptr, ptr %139, align 8, !tbaa !5
  %141 = icmp ne ptr %140, null
  br i1 %141, label %142, label %152

142:                                              ; preds = %136
  %143 = load ptr, ptr %28, align 8, !tbaa !8
  %144 = load i64, ptr %21, align 8, !tbaa !10
  %145 = load ptr, ptr %33, align 8, !tbaa !8
  %146 = load i64, ptr %27, align 8, !tbaa !10
  %147 = call i64 @IpSecEspAuthVerifyPayload(ptr noundef %143, i64 noundef %144, ptr noundef %145, i64 noundef %146)
  store i64 %147, ptr %19, align 8, !tbaa !10
  %148 = load i64, ptr %19, align 8, !tbaa !10
  %149 = icmp slt i64 %148, 0
  br i1 %149, label %150, label %151

150:                                              ; preds = %142
  br label %360

151:                                              ; preds = %142
  br label %152

152:                                              ; preds = %151, %136
  %153 = load ptr, ptr %32, align 8, !tbaa !8
  %154 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %153, i32 0, i32 4
  %155 = getelementptr inbounds %struct._EFI_IPSEC_ESP_ALGO_INFO, ptr %154, i32 0, i32 2
  %156 = load ptr, ptr %155, align 8, !tbaa !5
  %157 = icmp ne ptr %156, null
  br i1 %157, label %158, label %199

158:                                              ; preds = %152
  %159 = load ptr, ptr %33, align 8, !tbaa !8
  %160 = getelementptr inbounds %struct._IPSEC_SAD_ENTRY, ptr %159, i32 0, i32 1
  %161 = load ptr, ptr %160, align 8, !tbaa !21
  %162 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %161, i32 0, i32 4
  %163 = getelementptr inbounds %struct._EFI_IPSEC_ESP_ALGO_INFO, ptr %162, i32 0, i32 0
  %164 = load i8, ptr %163, align 8, !tbaa !5
  %165 = load ptr, ptr %33, align 8, !tbaa !8
  %166 = getelementptr inbounds %struct._IPSEC_SAD_ENTRY, ptr %165, i32 0, i32 1
  %167 = load ptr, ptr %166, align 8, !tbaa !21
  %168 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %167, i32 0, i32 4
  %169 = getelementptr inbounds %struct._EFI_IPSEC_ESP_ALGO_INFO, ptr %168, i32 0, i32 2
  %170 = load ptr, ptr %169, align 8, !tbaa !5
  %171 = load ptr, ptr %33, align 8, !tbaa !8
  %172 = getelementptr inbounds %struct._IPSEC_SAD_ENTRY, ptr %171, i32 0, i32 1
  %173 = load ptr, ptr %172, align 8, !tbaa !21
  %174 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %173, i32 0, i32 4
  %175 = getelementptr inbounds %struct._EFI_IPSEC_ESP_ALGO_INFO, ptr %174, i32 0, i32 1
  %176 = load i64, ptr %175, align 8, !tbaa !5
  %177 = shl i64 %176, 3
  %178 = load ptr, ptr %28, align 8, !tbaa !8
  %179 = getelementptr inbounds i8, ptr %178, i64 8
  %180 = load ptr, ptr %28, align 8, !tbaa !8
  %181 = getelementptr inbounds i8, ptr %180, i64 8
  %182 = load i64, ptr %22, align 8, !tbaa !10
  %183 = getelementptr inbounds i8, ptr %181, i64 %182
  %184 = load i64, ptr %21, align 8, !tbaa !10
  %185 = sub i64 %184, 8
  %186 = load i64, ptr %22, align 8, !tbaa !10
  %187 = sub i64 %185, %186
  %188 = load i64, ptr %27, align 8, !tbaa !10
  %189 = sub i64 %187, %188
  %190 = load ptr, ptr %28, align 8, !tbaa !8
  %191 = getelementptr inbounds i8, ptr %190, i64 8
  %192 = load i64, ptr %22, align 8, !tbaa !10
  %193 = getelementptr inbounds i8, ptr %191, i64 %192
  %194 = call i64 @IpSecCryptoIoDecrypt(i8 noundef zeroext %164, ptr noundef %170, i64 noundef %177, ptr noundef %179, ptr noundef %183, i64 noundef %189, ptr noundef %193)
  store i64 %194, ptr %19, align 8, !tbaa !10
  %195 = load i64, ptr %19, align 8, !tbaa !10
  %196 = icmp slt i64 %195, 0
  br i1 %196, label %197, label %198

197:                                              ; preds = %158
  br label %360

198:                                              ; preds = %158
  br label %199

199:                                              ; preds = %198, %152
  %200 = load ptr, ptr %28, align 8, !tbaa !8
  %201 = load i64, ptr %21, align 8, !tbaa !10
  %202 = getelementptr inbounds i8, ptr %200, i64 %201
  %203 = load i64, ptr %27, align 8, !tbaa !10
  %204 = sub i64 0, %203
  %205 = getelementptr inbounds i8, ptr %202, i64 %204
  %206 = getelementptr inbounds i8, ptr %205, i64 -2
  store ptr %206, ptr %30, align 8, !tbaa !8
  %207 = load ptr, ptr %30, align 8, !tbaa !8
  %208 = getelementptr inbounds %struct._EFI_ESP_TAIL, ptr %207, i32 0, i32 0
  %209 = load i8, ptr %208, align 1, !tbaa !27
  %210 = zext i8 %209 to i64
  store i64 %210, ptr %26, align 8, !tbaa !10
  %211 = load ptr, ptr %30, align 8, !tbaa !8
  %212 = getelementptr inbounds %struct._EFI_ESP_TAIL, ptr %211, i32 0, i32 1
  %213 = load i8, ptr %212, align 1, !tbaa !29
  store i8 %213, ptr %35, align 1, !tbaa !5
  %214 = load i64, ptr %21, align 8, !tbaa !10
  %215 = load i64, ptr %24, align 8, !tbaa !10
  %216 = add i64 %215, 2
  %217 = load i64, ptr %26, align 8, !tbaa !10
  %218 = add i64 %216, %217
  %219 = icmp ule i64 %214, %218
  br i1 %219, label %220, label %221

220:                                              ; preds = %199
  store i64 -9223372036854775793, ptr %19, align 8, !tbaa !10
  br label %360

221:                                              ; preds = %199
  %222 = load i64, ptr %21, align 8, !tbaa !10
  %223 = load i64, ptr %24, align 8, !tbaa !10
  %224 = sub i64 %222, %223
  %225 = sub i64 %224, 2
  %226 = load i64, ptr %26, align 8, !tbaa !10
  %227 = sub i64 %225, %226
  store i64 %227, ptr %25, align 8, !tbaa !10
  %228 = call ptr @AllocateZeroPool(i64 noundef 16)
  store ptr %228, ptr %34, align 8, !tbaa !8
  %229 = load ptr, ptr %34, align 8, !tbaa !8
  %230 = icmp eq ptr %229, null
  br i1 %230, label %231, label %232

231:                                              ; preds = %221
  store i64 -9223372036854775799, ptr %19, align 8, !tbaa !10
  br label %360

232:                                              ; preds = %221
  %233 = load ptr, ptr @gBS, align 8, !tbaa !8
  %234 = getelementptr inbounds %struct.EFI_BOOT_SERVICES, ptr %233, i32 0, i32 8
  %235 = load ptr, ptr %234, align 8, !tbaa !30
  %236 = load ptr, ptr %34, align 8, !tbaa !8
  %237 = load ptr, ptr %18, align 8, !tbaa !8
  %238 = call i64 %235(i32 noundef 512, i64 noundef 16, ptr noundef @IpSecRecycleCallback, ptr noundef %236, ptr noundef %237)
  store i64 %238, ptr %19, align 8, !tbaa !10
  %239 = load i64, ptr %19, align 8, !tbaa !10
  %240 = icmp slt i64 %239, 0
  br i1 %240, label %241, label %242

241:                                              ; preds = %232
  br label %360

242:                                              ; preds = %232
  %243 = call ptr @AllocateZeroPool(i64 noundef 16)
  %244 = load ptr, ptr %15, align 8, !tbaa !8
  store ptr %243, ptr %244, align 8, !tbaa !8
  %245 = load ptr, ptr %15, align 8, !tbaa !8
  %246 = load ptr, ptr %245, align 8, !tbaa !8
  %247 = icmp eq ptr %246, null
  br i1 %247, label %248, label %249

248:                                              ; preds = %242
  store i64 -9223372036854775799, ptr %19, align 8, !tbaa !10
  br label %360

249:                                              ; preds = %242
  %250 = load ptr, ptr %28, align 8, !tbaa !8
  %251 = load ptr, ptr %34, align 8, !tbaa !8
  %252 = getelementptr inbounds %struct._IPSEC_RECYCLE_CONTEXT, ptr %251, i32 0, i32 1
  store ptr %250, ptr %252, align 8, !tbaa !33
  %253 = load ptr, ptr %15, align 8, !tbaa !8
  %254 = load ptr, ptr %253, align 8, !tbaa !8
  %255 = load ptr, ptr %34, align 8, !tbaa !8
  %256 = getelementptr inbounds %struct._IPSEC_RECYCLE_CONTEXT, ptr %255, i32 0, i32 0
  store ptr %254, ptr %256, align 8, !tbaa !35
  %257 = load ptr, ptr %32, align 8, !tbaa !8
  %258 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %257, i32 0, i32 0
  %259 = load i32, ptr %258, align 8, !tbaa !36
  %260 = icmp eq i32 %259, 1
  br i1 %260, label %261, label %299

261:                                              ; preds = %249
  %262 = load ptr, ptr %28, align 8, !tbaa !8
  %263 = getelementptr inbounds i8, ptr %262, i64 8
  %264 = load i64, ptr %22, align 8, !tbaa !10
  %265 = getelementptr inbounds i8, ptr %263, i64 %264
  store ptr %265, ptr %37, align 8, !tbaa !8
  %266 = load ptr, ptr %11, align 8, !tbaa !8
  %267 = load ptr, ptr %37, align 8, !tbaa !8
  %268 = load i8, ptr %10, align 1, !tbaa !5
  %269 = load ptr, ptr %32, align 8, !tbaa !8
  %270 = load ptr, ptr %12, align 8, !tbaa !8
  call void @IpSecTunnelInboundPacket(ptr noundef %266, ptr noundef %267, i8 noundef zeroext %268, ptr noundef %269, ptr noundef %270)
  %271 = load i8, ptr %10, align 1, !tbaa !5
  %272 = zext i8 %271 to i32
  %273 = icmp eq i32 %272, 4
  br i1 %273, label %274, label %286

274:                                              ; preds = %261
  %275 = load ptr, ptr %37, align 8, !tbaa !8
  %276 = load ptr, ptr %15, align 8, !tbaa !8
  %277 = load ptr, ptr %276, align 8, !tbaa !8
  %278 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %277, i64 0
  %279 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %278, i32 0, i32 1
  store ptr %275, ptr %279, align 8, !tbaa !37
  %280 = load i64, ptr %25, align 8, !tbaa !10
  %281 = trunc i64 %280 to i32
  %282 = load ptr, ptr %15, align 8, !tbaa !8
  %283 = load ptr, ptr %282, align 8, !tbaa !8
  %284 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %283, i64 0
  %285 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %284, i32 0, i32 0
  store i32 %281, ptr %285, align 8, !tbaa !39
  br label %298

286:                                              ; preds = %261
  %287 = load ptr, ptr %37, align 8, !tbaa !8
  %288 = load ptr, ptr %15, align 8, !tbaa !8
  %289 = load ptr, ptr %288, align 8, !tbaa !8
  %290 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %289, i64 0
  %291 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %290, i32 0, i32 1
  store ptr %287, ptr %291, align 8, !tbaa !37
  %292 = load i64, ptr %25, align 8, !tbaa !10
  %293 = trunc i64 %292 to i32
  %294 = load ptr, ptr %15, align 8, !tbaa !8
  %295 = load ptr, ptr %294, align 8, !tbaa !8
  %296 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %295, i64 0
  %297 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %296, i32 0, i32 0
  store i32 %293, ptr %297, align 8, !tbaa !39
  br label %298

298:                                              ; preds = %286, %274
  br label %314

299:                                              ; preds = %249
  %300 = load ptr, ptr %28, align 8, !tbaa !8
  %301 = getelementptr inbounds i8, ptr %300, i64 8
  %302 = load i64, ptr %22, align 8, !tbaa !10
  %303 = getelementptr inbounds i8, ptr %301, i64 %302
  %304 = load ptr, ptr %15, align 8, !tbaa !8
  %305 = load ptr, ptr %304, align 8, !tbaa !8
  %306 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %305, i64 0
  %307 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %306, i32 0, i32 1
  store ptr %303, ptr %307, align 8, !tbaa !37
  %308 = load i64, ptr %25, align 8, !tbaa !10
  %309 = trunc i64 %308 to i32
  %310 = load ptr, ptr %15, align 8, !tbaa !8
  %311 = load ptr, ptr %310, align 8, !tbaa !8
  %312 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %311, i64 0
  %313 = getelementptr inbounds %struct._EFI_IPSEC_FRAGMENT_DATA, ptr %312, i32 0, i32 0
  store i32 %309, ptr %313, align 8, !tbaa !39
  br label %314

314:                                              ; preds = %299, %298
  %315 = load ptr, ptr %16, align 8, !tbaa !8
  store i32 1, ptr %315, align 4, !tbaa !12
  %316 = load ptr, ptr %32, align 8, !tbaa !8
  %317 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %316, i32 0, i32 0
  %318 = load i32, ptr %317, align 8, !tbaa !36
  %319 = icmp ne i32 %318, 0
  %320 = xor i1 %319, true
  %321 = zext i1 %320 to i32
  %322 = icmp eq i32 %321, 1
  br i1 %322, label %323, label %355

323:                                              ; preds = %314
  %324 = load i8, ptr %10, align 1, !tbaa !5
  %325 = zext i8 %324 to i32
  %326 = icmp eq i32 %325, 4
  br i1 %326, label %327, label %340

327:                                              ; preds = %323
  %328 = load ptr, ptr %11, align 8, !tbaa !8
  %329 = load i8, ptr %328, align 1
  %330 = and i8 %329, 15
  %331 = zext i8 %330 to i32
  %332 = shl i32 %331, 2
  %333 = sext i32 %332 to i64
  %334 = load i64, ptr %25, align 8, !tbaa !10
  %335 = add i64 %333, %334
  %336 = trunc i64 %335 to i16
  %337 = call zeroext i16 @SwapBytes16(i16 noundef zeroext %336)
  %338 = load ptr, ptr %11, align 8, !tbaa !8
  %339 = getelementptr inbounds %struct.IP4_HEAD, ptr %338, i32 0, i32 2
  store i16 %337, ptr %339, align 1, !tbaa !40
  br label %352

340:                                              ; preds = %323
  %341 = load ptr, ptr %11, align 8, !tbaa !8
  %342 = load ptr, ptr %12, align 8, !tbaa !8
  %343 = call zeroext i16 @IpSecGetPlainExtHeadSize(ptr noundef %341, ptr noundef %342)
  store i16 %343, ptr %36, align 2, !tbaa !43
  %344 = load i16, ptr %36, align 2, !tbaa !43
  %345 = zext i16 %344 to i64
  %346 = load i64, ptr %25, align 8, !tbaa !10
  %347 = add i64 %345, %346
  %348 = trunc i64 %347 to i16
  %349 = call zeroext i16 @SwapBytes16(i16 noundef zeroext %348)
  %350 = load ptr, ptr %11, align 8, !tbaa !8
  %351 = getelementptr inbounds %struct._EFI_IP6_HEADER, ptr %350, i32 0, i32 2
  store i16 %349, ptr %351, align 1, !tbaa !44
  br label %352

352:                                              ; preds = %340, %327
  %353 = load i8, ptr %35, align 1, !tbaa !5
  %354 = load ptr, ptr %12, align 8, !tbaa !8
  store i8 %353, ptr %354, align 1, !tbaa !5
  br label %355

355:                                              ; preds = %352, %314
  %356 = load ptr, ptr %32, align 8, !tbaa !8
  %357 = getelementptr inbounds %struct._IPSEC_SAD_DATA, ptr %356, i32 0, i32 8
  %358 = load ptr, ptr %357, align 8, !tbaa !47
  %359 = load ptr, ptr %17, align 8, !tbaa !8
  store ptr %358, ptr %359, align 8, !tbaa !8
  br label %360

360:                                              ; preds = %355, %248, %241, %231, %220, %197, %150, %135, %127, %91, %79, %67, %56, %46
  %361 = load ptr, ptr %20, align 8, !tbaa !8
  %362 = icmp ne ptr %361, null
  br i1 %362, label %363, label %365

363:                                              ; preds = %360
  %364 = load ptr, ptr %20, align 8, !tbaa !8
  call void @NetbufFree(ptr noundef %364)
  br label %365

365:                                              ; preds = %363, %360
  %366 = load i64, ptr %19, align 8, !tbaa !10
  %367 = icmp slt i64 %366, 0
  br i1 %367, label %368, label %390

368:                                              ; preds = %365
  %369 = load ptr, ptr %28, align 8, !tbaa !8
  %370 = icmp ne ptr %369, null
  br i1 %370, label %371, label %373

371:                                              ; preds = %368
  %372 = load ptr, ptr %28, align 8, !tbaa !8
  call void @FreePool(ptr noundef %372)
  br label %373

373:                                              ; preds = %371, %368
  %374 = load ptr, ptr %34, align 8, !tbaa !8
  %375 = icmp ne ptr %374, null
  br i1 %375, label %376, label %378

376:                                              ; preds = %373
  %377 = load ptr, ptr %34, align 8, !tbaa !8
  call void @FreePool(ptr noundef %377)
  br label %378

378:                                              ; preds = %376, %373
  %379 = load ptr, ptr %18, align 8, !tbaa !8
  %380 = load ptr, ptr %379, align 8, !tbaa !8
  %381 = icmp ne ptr %380, null
  br i1 %381, label %382, label %389

382:                                              ; preds = %378
  %383 = load ptr, ptr @gBS, align 8, !tbaa !8
  %384 = getelementptr inbounds %struct.EFI_BOOT_SERVICES, ptr %383, i32 0, i32 12
  %385 = load ptr, ptr %384, align 8, !tbaa !48
  %386 = load ptr, ptr %18, align 8, !tbaa !8
  %387 = load ptr, ptr %386, align 8, !tbaa !8
  %388 = call i64 %385(ptr noundef %387)
  br label %389

389:                                              ; preds = %382, %378
  br label %390

390:                                              ; preds = %389, %365
  %391 = load i64, ptr %19, align 8, !tbaa !10
  call void @llvm.lifetime.end.p0(i64 8, ptr %37) #3
  call void @llvm.lifetime.end.p0(i64 2, ptr %36) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %35) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %34) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %33) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %32) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %31) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %30) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %29) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %28) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %27) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %26) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %25) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %24) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %23) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %22) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %21) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %20) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %19) #3
  ret i64 %391
}

declare i32 @SwapBytes32(i32 noundef) #1

declare i32 @NetbufCopy(ptr noundef, i32 noundef, i32 noundef, ptr noundef) #1

declare i64 @IpSecGetIcvLength(i8 noundef zeroext) #1

declare i64 @IpSecGetEncryptIvLength(i8 noundef zeroext) #1

declare i64 @IpSecGetEncryptBlockSize(i8 noundef zeroext) #1

declare i64 @IpSecCryptoIoDecrypt(i8 noundef zeroext, ptr noundef, i64 noundef, ptr noundef, ptr noundef, i64 noundef, ptr noundef) #1

attributes #0 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #1 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #2 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"omnipotent char", !7, i64 0}
!7 = !{!"Simple C/C++ TBAA"}
!8 = !{!9, !9, i64 0}
!9 = !{!"any pointer", !6, i64 0}
!10 = !{!11, !11, i64 0}
!11 = !{!"long long", !6, i64 0}
!12 = !{!13, !13, i64 0}
!13 = !{!"int", !6, i64 0}
!14 = !{!15, !13, i64 132}
!15 = !{!"", !13, i64 0, !11, i64 8, !16, i64 16, !6, i64 32, !9, i64 40, !9, i64 48, !6, i64 56, !9, i64 120, !13, i64 128, !13, i64 132, !6, i64 136}
!16 = !{!"_LIST_ENTRY", !9, i64 0, !9, i64 8}
!17 = !{!18, !13, i64 0}
!18 = !{!"_EFI_ESP_HEADER", !13, i64 0, !13, i64 4}
!19 = !{!20, !9, i64 0}
!20 = !{!"_IPSEC_SAD_ENTRY", !9, i64 0, !9, i64 8, !16, i64 16, !16, i64 32}
!21 = !{!20, !9, i64 8}
!22 = !{!23, !13, i64 4}
!23 = !{!"_EFI_IPSEC_SA_ID", !13, i64 0, !13, i64 4, !6, i64 8}
!24 = !{!25, !6, i64 153}
!25 = !{!"_IPSEC_SAD_DATA", !13, i64 0, !11, i64 8, !6, i64 16, !6, i64 24, !6, i64 56, !26, i64 104, !13, i64 128, !9, i64 136, !9, i64 144, !6, i64 152, !6, i64 153, !6, i64 156, !6, i64 172}
!26 = !{!"_EFI_IPSEC_SA_LIFETIME", !11, i64 0, !11, i64 8, !11, i64 16}
!27 = !{!28, !6, i64 0}
!28 = !{!"_EFI_ESP_TAIL", !6, i64 0, !6, i64 1}
!29 = !{!28, !6, i64 1}
!30 = !{!31, !9, i64 80}
!31 = !{!"", !32, i64 0, !9, i64 24, !9, i64 32, !9, i64 40, !9, i64 48, !9, i64 56, !9, i64 64, !9, i64 72, !9, i64 80, !9, i64 88, !9, i64 96, !9, i64 104, !9, i64 112, !9, i64 120, !9, i64 128, !9, i64 136, !9, i64 144, !9, i64 152, !9, i64 160, !9, i64 168, !9, i64 176, !9, i64 184, !9, i64 192, !9, i64 200, !9, i64 208, !9, i64 216, !9, i64 224, !9, i64 232, !9, i64 240, !9, i64 248, !9, i64 256, !9, i64 264, !9, i64 272, !9, i64 280, !9, i64 288, !9, i64 296, !9, i64 304, !9, i64 312, !9, i64 320, !9, i64 328, !9, i64 336, !9, i64 344, !9, i64 352, !9, i64 360, !9, i64 368}
!32 = !{!"", !11, i64 0, !13, i64 8, !13, i64 12, !13, i64 16, !13, i64 20}
!33 = !{!34, !9, i64 8}
!34 = !{!"_IPSEC_RECYCLE_CONTEXT", !9, i64 0, !9, i64 8}
!35 = !{!34, !9, i64 0}
!36 = !{!25, !13, i64 0}
!37 = !{!38, !9, i64 8}
!38 = !{!"_EFI_IPSEC_FRAGMENT_DATA", !13, i64 0, !9, i64 8}
!39 = !{!38, !13, i64 0}
!40 = !{!41, !42, i64 2}
!41 = !{!"", !6, i64 0, !6, i64 0, !6, i64 1, !42, i64 2, !42, i64 4, !42, i64 6, !6, i64 8, !6, i64 9, !42, i64 10, !13, i64 12, !13, i64 16}
!42 = !{!"short", !6, i64 0}
!43 = !{!42, !42, i64 0}
!44 = !{!45, !42, i64 4}
!45 = !{!"_EFI_IP6_HEADER", !6, i64 0, !6, i64 0, !6, i64 1, !6, i64 1, !42, i64 2, !42, i64 4, !6, i64 6, !6, i64 7, !46, i64 8, !46, i64 24}
!46 = !{!"", !6, i64 0}
!47 = !{!25, !9, i64 144}
!48 = !{!31, !9, i64 112}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@gBS = external local_unnamed_addr global ptr, align 8

declare zeroext i16 @SwapBytes16(i16 noundef zeroext) local_unnamed_addr #0

; Function Attrs: nounwind uwtable
declare dso_local void @IpSecOnRecyclePacket(ptr noundef) #1

; Function Attrs: nounwind uwtable
declare dso_local void @IpSecRecycleCallback(ptr noundef, ptr noundef) #1

declare void @FreePool(ptr noundef) local_unnamed_addr #0

; Function Attrs: nounwind uwtable
declare dso_local zeroext i16 @IpSecGetPlainExtHeadSize(ptr noundef, ptr noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
declare dso_local i64 @IpSecEspAuthVerifyPayload(ptr noundef, i64 noundef, ptr noundef, i64 noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
declare dso_local ptr @IpSecFoundSadFromInboundPacket(ptr noundef, i8 noundef zeroext, i32 noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
declare dso_local void @IpSecTunnelInboundPacket(ptr noundef, ptr noundef, i8 noundef zeroext, ptr noundef, ptr noundef) local_unnamed_addr #1

declare ptr @AllocateZeroPool(i64 noundef) local_unnamed_addr #0

declare ptr @NetbufFromExt(ptr noundef, i32 noundef, i32 noundef, i32 noundef, ptr noundef, ptr noundef) local_unnamed_addr #0

declare ptr @NetbufGetByte(ptr noundef, i32 noundef, ptr noundef) local_unnamed_addr #0

declare void @NetbufFree(ptr noundef) local_unnamed_addr #0

; Function Attrs: nounwind uwtable
define dso_local i64 @IpSecEspInboundPacket(i8 noundef zeroext %0, ptr noundef %1, ptr noundef %2, ptr nocapture noundef readnone %3, ptr nocapture noundef readnone %4, ptr nocapture noundef %5, ptr nocapture noundef %6, ptr nocapture noundef writeonly %7, ptr noundef %8) local_unnamed_addr #1 {
  store ptr null, ptr %8, align 8, !tbaa !5
  %10 = load ptr, ptr %5, align 8, !tbaa !5
  %11 = load i32, ptr %6, align 4, !tbaa !9
  %12 = tail call ptr @NetbufFromExt(ptr noundef %10, i32 noundef %11, i32 noundef 0, i32 noundef 8, ptr noundef nonnull @IpSecOnRecyclePacket, ptr noundef null) #2
  %13 = icmp eq ptr %12, null
  br i1 %13, label %.thread184, label %14

14:                                               ; preds = %9
  %15 = getelementptr inbounds i8, ptr %12, i64 132
  %16 = load i32, ptr %15, align 4, !tbaa !11
  %17 = zext i32 %16 to i64
  %18 = tail call ptr @NetbufGetByte(ptr noundef nonnull %12, i32 noundef 0, ptr noundef null) #2
  %19 = icmp eq ptr %18, null
  br i1 %19, label %139, label %20

20:                                               ; preds = %14
  %21 = load i32, ptr %18, align 1, !tbaa !15
  %22 = tail call i32 @SwapBytes32(i32 noundef %21) #2
  %23 = tail call ptr @IpSecFoundSadFromInboundPacket(ptr noundef %1, i8 noundef zeroext %0, i32 noundef %22)
  %24 = icmp eq ptr %23, null
  br i1 %24, label %139, label %25

25:                                               ; preds = %20
  %26 = load ptr, ptr %23, align 8, !tbaa !17
  %27 = getelementptr inbounds i8, ptr %23, i64 8
  %28 = load ptr, ptr %27, align 8, !tbaa !19
  %29 = getelementptr inbounds i8, ptr %26, i64 4
  %30 = load i32, ptr %29, align 4, !tbaa !20
  %.not = icmp eq i32 %30, 1
  br i1 %.not, label %31, label %139

31:                                               ; preds = %25
  %32 = tail call ptr @AllocateZeroPool(i64 noundef %17) #2
  %33 = icmp eq ptr %32, null
  br i1 %33, label %139, label %34

34:                                               ; preds = %31
  %35 = tail call i32 @NetbufCopy(ptr noundef nonnull %12, i32 noundef 0, i32 noundef %16, ptr noundef nonnull %32) #2
  %36 = load ptr, ptr %27, align 8, !tbaa !19
  %37 = getelementptr inbounds i8, ptr %36, i64 80
  %38 = load i8, ptr %37, align 8, !tbaa !22
  %39 = tail call i64 @IpSecGetIcvLength(i8 noundef zeroext %38) #2
  %40 = sub i64 0, %39
  %41 = load ptr, ptr %27, align 8, !tbaa !19
  %42 = getelementptr inbounds i8, ptr %41, i64 56
  %43 = load i8, ptr %42, align 8, !tbaa !22
  %44 = tail call i64 @IpSecGetEncryptIvLength(i8 noundef zeroext %43) #2
  %45 = load ptr, ptr %27, align 8, !tbaa !19
  %46 = getelementptr inbounds i8, ptr %45, i64 56
  %47 = load i8, ptr %46, align 8, !tbaa !22
  %48 = tail call i64 @IpSecGetEncryptBlockSize(i8 noundef zeroext %47) #2
  %49 = add i64 %44, %39
  %50 = add i64 %49, 10
  %.not132 = icmp ult i64 %50, %17
  br i1 %.not132, label %51, label %140

51:                                               ; preds = %34
  %52 = add nsw i64 %49, 8
  %53 = sub nsw i64 %17, %52
  %54 = urem i64 %53, %48
  %.not133 = icmp eq i64 %54, 0
  br i1 %.not133, label %55, label %140

55:                                               ; preds = %51
  %56 = getelementptr inbounds i8, ptr %28, i64 96
  %57 = load ptr, ptr %56, align 8, !tbaa !22
  %.not134 = icmp eq ptr %57, null
  br i1 %.not134, label %61, label %58

58:                                               ; preds = %55
  %59 = tail call i64 @IpSecEspAuthVerifyPayload(ptr noundef nonnull %32, i64 noundef %17, ptr noundef nonnull %23, i64 noundef %39)
  %60 = icmp slt i64 %59, 0
  br i1 %60, label %140, label %61

61:                                               ; preds = %58, %55
  %62 = getelementptr inbounds i8, ptr %28, i64 72
  %63 = load ptr, ptr %62, align 8, !tbaa !22
  %.not135 = icmp eq ptr %63, null
  br i1 %.not135, label %78, label %64

64:                                               ; preds = %61
  %65 = load ptr, ptr %27, align 8, !tbaa !19
  %66 = getelementptr inbounds i8, ptr %65, i64 56
  %67 = load i8, ptr %66, align 8, !tbaa !22
  %68 = getelementptr inbounds i8, ptr %65, i64 72
  %69 = load ptr, ptr %68, align 8, !tbaa !22
  %70 = getelementptr inbounds i8, ptr %65, i64 64
  %71 = load i64, ptr %70, align 8, !tbaa !22
  %72 = shl i64 %71, 3
  %73 = getelementptr inbounds i8, ptr %32, i64 8
  %74 = getelementptr inbounds i8, ptr %73, i64 %44
  %.neg189 = add nsw i64 %17, -8
  %75 = sub nsw i64 %.neg189, %49
  %76 = tail call i64 @IpSecCryptoIoDecrypt(i8 noundef zeroext %67, ptr noundef %69, i64 noundef %72, ptr noundef nonnull %73, ptr noundef nonnull %74, i64 noundef %75, ptr noundef nonnull %74) #2
  %77 = icmp slt i64 %76, 0
  br i1 %77, label %140, label %78

78:                                               ; preds = %64, %61
  %79 = getelementptr inbounds i8, ptr %32, i64 %17
  %80 = getelementptr inbounds i8, ptr %79, i64 %40
  %81 = getelementptr inbounds i8, ptr %80, i64 -2
  %82 = load i8, ptr %81, align 1, !tbaa !23
  %83 = zext i8 %82 to i64
  %84 = getelementptr inbounds i8, ptr %80, i64 -1
  %85 = load i8, ptr %84, align 1, !tbaa !25
  %86 = add nuw nsw i64 %50, %83
  %.not136 = icmp ult i64 %86, %17
  br i1 %.not136, label %87, label %140

87:                                               ; preds = %78
  %88 = add nsw i64 %53, -2
  %89 = sub nsw i64 %88, %83
  %90 = tail call ptr @AllocateZeroPool(i64 noundef 16) #2
  %91 = icmp eq ptr %90, null
  br i1 %91, label %140, label %92

92:                                               ; preds = %87
  %93 = load ptr, ptr @gBS, align 8, !tbaa !5
  %94 = getelementptr inbounds i8, ptr %93, i64 80
  %95 = load ptr, ptr %94, align 8, !tbaa !26
  %96 = tail call i64 %95(i32 noundef 512, i64 noundef 16, ptr noundef nonnull @IpSecRecycleCallback, ptr noundef nonnull %90, ptr noundef nonnull %8) #2
  %97 = icmp slt i64 %96, 0
  br i1 %97, label %140, label %98

98:                                               ; preds = %92
  %99 = tail call ptr @AllocateZeroPool(i64 noundef 16) #2
  store ptr %99, ptr %5, align 8, !tbaa !5
  %100 = icmp eq ptr %99, null
  br i1 %100, label %140, label %101

101:                                              ; preds = %98
  %102 = getelementptr inbounds i8, ptr %90, i64 8
  store ptr %32, ptr %102, align 8, !tbaa !29
  %103 = load ptr, ptr %5, align 8, !tbaa !5
  store ptr %103, ptr %90, align 8, !tbaa !31
  %104 = load i32, ptr %28, align 8, !tbaa !32
  %105 = icmp eq i32 %104, 1
  %106 = getelementptr inbounds i8, ptr %32, i64 8
  %107 = getelementptr inbounds i8, ptr %106, i64 %44
  br i1 %105, label %108, label %114

108:                                              ; preds = %101
  tail call void @IpSecTunnelInboundPacket(ptr noundef %1, ptr noundef nonnull %107, i8 noundef zeroext %0, ptr noundef nonnull %28, ptr noundef %2)
  %109 = icmp eq i8 %0, 4
  %110 = load ptr, ptr %5, align 8, !tbaa !5
  %111 = getelementptr inbounds i8, ptr %110, i64 8
  store ptr %107, ptr %111, align 8, !tbaa !35
  %112 = trunc i64 %89 to i32
  %113 = load ptr, ptr %5, align 8, !tbaa !5
  store i32 %112, ptr %113, align 8, !tbaa !37
  br i1 %109, label %.thread, label %118

114:                                              ; preds = %101
  %115 = getelementptr inbounds i8, ptr %103, i64 8
  store ptr %107, ptr %115, align 8, !tbaa !35
  %116 = trunc i64 %89 to i32
  %117 = load ptr, ptr %5, align 8, !tbaa !5
  store i32 %116, ptr %117, align 8, !tbaa !37
  br label %118

118:                                              ; preds = %108, %114
  store i32 1, ptr %6, align 4, !tbaa !9
  %119 = load i32, ptr %28, align 8, !tbaa !32
  %.not137 = icmp eq i32 %119, 0
  br i1 %.not137, label %121, label %136

.thread:                                          ; preds = %108
  store i32 1, ptr %6, align 4, !tbaa !9
  %120 = load i32, ptr %28, align 8, !tbaa !32
  %.not137142 = icmp eq i32 %120, 0
  br i1 %.not137142, label %.thread143, label %136

121:                                              ; preds = %118
  %122 = icmp eq i8 %0, 4
  br i1 %122, label %.thread143, label %129

.thread143:                                       ; preds = %.thread, %121
  %123 = load i8, ptr %1, align 1
  %124 = shl i8 %123, 2
  %125 = and i8 %124, 60
  %126 = zext nneg i8 %125 to i64
  %127 = add nsw i64 %89, %126
  %128 = trunc i64 %127 to i16
  br label %133

129:                                              ; preds = %121
  %130 = tail call zeroext i16 @IpSecGetPlainExtHeadSize(ptr noundef %1, ptr noundef %2)
  %131 = trunc i64 %89 to i16
  %132 = add i16 %130, %131
  br label %133

133:                                              ; preds = %129, %.thread143
  %.sink193 = phi i16 [ %132, %129 ], [ %128, %.thread143 ]
  %.sink192 = phi i64 [ 4, %129 ], [ 2, %.thread143 ]
  %134 = tail call zeroext i16 @SwapBytes16(i16 noundef zeroext %.sink193) #2
  %135 = getelementptr inbounds i8, ptr %1, i64 %.sink192
  store i16 %134, ptr %135, align 1, !tbaa !38
  store i8 %85, ptr %2, align 1, !tbaa !22
  br label %136

136:                                              ; preds = %118, %133, %.thread
  %137 = getelementptr inbounds i8, ptr %28, i64 144
  %138 = load ptr, ptr %137, align 8, !tbaa !40
  store ptr %138, ptr %7, align 8, !tbaa !5
  tail call void @NetbufFree(ptr noundef nonnull %12) #2
  br label %148

139:                                              ; preds = %31, %25, %20, %14
  %.0.ph.ph = phi i64 [ -9223372036854775793, %14 ], [ -9223372036854775793, %20 ], [ -9223372036854775793, %25 ], [ -9223372036854775799, %31 ]
  tail call void @NetbufFree(ptr noundef nonnull %12) #2
  br label %.thread184

140:                                              ; preds = %98, %87, %78, %51, %34, %92, %64, %58
  %.0116.ph.ph.ph = phi ptr [ %90, %98 ], [ null, %87 ], [ null, %78 ], [ null, %51 ], [ null, %34 ], [ %90, %92 ], [ null, %64 ], [ null, %58 ]
  %.0.ph.ph.ph = phi i64 [ -9223372036854775799, %98 ], [ -9223372036854775799, %87 ], [ -9223372036854775793, %78 ], [ -9223372036854775793, %51 ], [ -9223372036854775793, %34 ], [ %96, %92 ], [ %76, %64 ], [ %59, %58 ]
  tail call void @NetbufFree(ptr noundef nonnull %12) #2
  tail call void @FreePool(ptr noundef nonnull %32) #2
  %.not140 = icmp eq ptr %.0116.ph.ph.ph, null
  br i1 %.not140, label %.thread184, label %141

141:                                              ; preds = %140
  tail call void @FreePool(ptr noundef nonnull %.0116.ph.ph.ph) #2
  br label %.thread184

.thread184:                                       ; preds = %9, %139, %141, %140
  %.0153159173188 = phi i64 [ %.0.ph.ph.ph, %141 ], [ %.0.ph.ph.ph, %140 ], [ %.0.ph.ph, %139 ], [ -9223372036854775799, %9 ]
  %142 = load ptr, ptr %8, align 8, !tbaa !5
  %.not141 = icmp eq ptr %142, null
  br i1 %.not141, label %148, label %143

143:                                              ; preds = %.thread184
  %144 = load ptr, ptr @gBS, align 8, !tbaa !5
  %145 = getelementptr inbounds i8, ptr %144, i64 112
  %146 = load ptr, ptr %145, align 8, !tbaa !41
  %147 = tail call i64 %146(ptr noundef nonnull %142) #2
  br label %148

148:                                              ; preds = %136, %.thread184, %143
  %.0153158 = phi i64 [ %.0153159173188, %.thread184 ], [ %.0153159173188, %143 ], [ %96, %136 ]
  ret i64 %.0153158
}

declare i32 @SwapBytes32(i32 noundef) local_unnamed_addr #0

declare i32 @NetbufCopy(ptr noundef, i32 noundef, i32 noundef, ptr noundef) local_unnamed_addr #0

declare i64 @IpSecGetIcvLength(i8 noundef zeroext) local_unnamed_addr #0

declare i64 @IpSecGetEncryptIvLength(i8 noundef zeroext) local_unnamed_addr #0

declare i64 @IpSecGetEncryptBlockSize(i8 noundef zeroext) local_unnamed_addr #0

declare i64 @IpSecCryptoIoDecrypt(i8 noundef zeroext, ptr noundef, i64 noundef, ptr noundef, ptr noundef, i64 noundef, ptr noundef) local_unnamed_addr #0

attributes #0 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #2 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !10, i64 0}
!10 = !{!"int", !7, i64 0}
!11 = !{!12, !10, i64 132}
!12 = !{!"", !10, i64 0, !13, i64 8, !14, i64 16, !7, i64 32, !6, i64 40, !6, i64 48, !7, i64 56, !6, i64 120, !10, i64 128, !10, i64 132, !7, i64 136}
!13 = !{!"long long", !7, i64 0}
!14 = !{!"_LIST_ENTRY", !6, i64 0, !6, i64 8}
!15 = !{!16, !10, i64 0}
!16 = !{!"_EFI_ESP_HEADER", !10, i64 0, !10, i64 4}
!17 = !{!18, !6, i64 0}
!18 = !{!"_IPSEC_SAD_ENTRY", !6, i64 0, !6, i64 8, !14, i64 16, !14, i64 32}
!19 = !{!18, !6, i64 8}
!20 = !{!21, !10, i64 4}
!21 = !{!"_EFI_IPSEC_SA_ID", !10, i64 0, !10, i64 4, !7, i64 8}
!22 = !{!7, !7, i64 0}
!23 = !{!24, !7, i64 0}
!24 = !{!"_EFI_ESP_TAIL", !7, i64 0, !7, i64 1}
!25 = !{!24, !7, i64 1}
!26 = !{!27, !6, i64 80}
!27 = !{!"", !28, i64 0, !6, i64 24, !6, i64 32, !6, i64 40, !6, i64 48, !6, i64 56, !6, i64 64, !6, i64 72, !6, i64 80, !6, i64 88, !6, i64 96, !6, i64 104, !6, i64 112, !6, i64 120, !6, i64 128, !6, i64 136, !6, i64 144, !6, i64 152, !6, i64 160, !6, i64 168, !6, i64 176, !6, i64 184, !6, i64 192, !6, i64 200, !6, i64 208, !6, i64 216, !6, i64 224, !6, i64 232, !6, i64 240, !6, i64 248, !6, i64 256, !6, i64 264, !6, i64 272, !6, i64 280, !6, i64 288, !6, i64 296, !6, i64 304, !6, i64 312, !6, i64 320, !6, i64 328, !6, i64 336, !6, i64 344, !6, i64 352, !6, i64 360, !6, i64 368}
!28 = !{!"", !13, i64 0, !10, i64 8, !10, i64 12, !10, i64 16, !10, i64 20}
!29 = !{!30, !6, i64 8}
!30 = !{!"_IPSEC_RECYCLE_CONTEXT", !6, i64 0, !6, i64 8}
!31 = !{!30, !6, i64 0}
!32 = !{!33, !10, i64 0}
!33 = !{!"_IPSEC_SAD_DATA", !10, i64 0, !13, i64 8, !7, i64 16, !7, i64 24, !7, i64 56, !34, i64 104, !10, i64 128, !6, i64 136, !6, i64 144, !7, i64 152, !7, i64 153, !7, i64 156, !7, i64 172}
!34 = !{!"_EFI_IPSEC_SA_LIFETIME", !13, i64 0, !13, i64 8, !13, i64 16}
!35 = !{!36, !6, i64 8}
!36 = !{!"_EFI_IPSEC_FRAGMENT_DATA", !10, i64 0, !6, i64 8}
!37 = !{!36, !10, i64 0}
!38 = !{!39, !39, i64 0}
!39 = !{!"short", !7, i64 0}
!40 = !{!33, !6, i64 144}
!41 = !{!27, !6, i64 112}


; Effective O3 passes: CorrelatedValuePropagationPass,EarlyCSEPass,GVNPass,GlobalOptPass,IPSCCPPass,InferFunctionAttrsPass,InstCombinePass,JumpThreadingPass,PostOrderFunctionAttrsPass,ReassociatePass,SROAPass,SimplifyCFGPass,TailCallElimPass