; LLVM IR from thalium/icebox :: third_party/virtualbox/src/VBox/Devices/EFI/Firmware/MdeModulePkg/Universal (PxeBcDiscvBootService)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN = type { i64, ptr, %struct.EFI_IPv4_ADDRESS, i16, %struct.EFI_IPv4_ADDRESS, i32, ptr, i32, ptr, i32, ptr }
%struct.EFI_IPv4_ADDRESS = type { [4 x i8] }
%struct.EFI_DHCP4_LISTEN_POINT = type { %struct.EFI_IPv4_ADDRESS, %struct.EFI_IPv4_ADDRESS, i16 }
%struct._PXEBC_PRIVATE_DATA = type { i32, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, %struct._EFI_PXE_BASE_CODE_PROTOCOL, %struct._EFI_LOAD_FILE_PROTOCOL, %struct._EFI_PXE_BASE_CODE_CALLBACK_PROTOCOL, ptr, ptr, ptr, ptr, %struct.EFI_IP4_CONFIG_DATA, ptr, ptr, ptr, i16, %struct.EFI_UDP4_CONFIG_DATA, %struct.EFI_PXE_BASE_CODE_MODE, i32, ptr, %union.EFI_IP_ADDRESS, %union.EFI_IP_ADDRESS, %union.EFI_IP_ADDRESS, %union.EFI_IP_ADDRESS, i8, i32, i64, i64, [312 x i8], %struct.EFI_DHCP4_PACKET, %struct.EFI_MAC_ADDRESS, i8, i8, i8, i32, i32, i32, %struct.PXEBC_CACHED_DHCP4_PACKET, %struct.PXEBC_CACHED_DHCP4_PACKET, %struct.PXEBC_CACHED_DHCP4_PACKET, [16 x %struct.PXEBC_CACHED_DHCP4_PACKET], [5 x i32], [5 x [16 x i32]], i32, [5 x i32], [16 x i32], ptr, %struct.EFI_IP4_COMPLETION_TOKEN }
%struct._EFI_PXE_BASE_CODE_PROTOCOL = type { i64, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr }
%struct._EFI_LOAD_FILE_PROTOCOL = type { ptr }
%struct._EFI_PXE_BASE_CODE_CALLBACK_PROTOCOL = type { i64, ptr }
%struct.EFI_IP4_CONFIG_DATA = type { i8, i8, i8, i8, i8, i8, %struct.EFI_IPv4_ADDRESS, %struct.EFI_IPv4_ADDRESS, i8, i8, i8, i8, i32, i32 }
%struct.EFI_UDP4_CONFIG_DATA = type { i8, i8, i8, i8, i8, i8, i8, i32, i32, i8, %struct.EFI_IPv4_ADDRESS, %struct.EFI_IPv4_ADDRESS, i16, %struct.EFI_IPv4_ADDRESS, i16 }
%struct.EFI_PXE_BASE_CODE_MODE = type { i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, i8, %union.EFI_IP_ADDRESS, %union.EFI_IP_ADDRESS, %union.EFI_PXE_BASE_CODE_PACKET, %union.EFI_PXE_BASE_CODE_PACKET, %union.EFI_PXE_BASE_CODE_PACKET, %union.EFI_PXE_BASE_CODE_PACKET, %union.EFI_PXE_BASE_CODE_PACKET, %union.EFI_PXE_BASE_CODE_PACKET, %struct.EFI_PXE_BASE_CODE_IP_FILTER, i32, [8 x %struct.EFI_PXE_BASE_CODE_ARP_ENTRY], i32, [8 x %struct.EFI_PXE_BASE_CODE_ROUTE_ENTRY], %struct.EFI_PXE_BASE_CODE_ICMP_ERROR, %struct.EFI_PXE_BASE_CODE_TFTP_ERROR }
%union.EFI_PXE_BASE_CODE_PACKET = type { %struct.EFI_PXE_BASE_CODE_DHCPV6_PACKET, [444 x i8] }
%struct.EFI_PXE_BASE_CODE_DHCPV6_PACKET = type { i32, [1024 x i8] }
%struct.EFI_PXE_BASE_CODE_IP_FILTER = type { i8, i8, i16, [8 x %union.EFI_IP_ADDRESS] }
%struct.EFI_PXE_BASE_CODE_ARP_ENTRY = type { %union.EFI_IP_ADDRESS, %struct.EFI_MAC_ADDRESS }
%struct.EFI_PXE_BASE_CODE_ROUTE_ENTRY = type { %union.EFI_IP_ADDRESS, %union.EFI_IP_ADDRESS, %union.EFI_IP_ADDRESS }
%struct.EFI_PXE_BASE_CODE_ICMP_ERROR = type { i8, i8, i16, %union.anon, [494 x i8] }
%union.anon = type { i32 }
%struct.EFI_PXE_BASE_CODE_TFTP_ERROR = type { i8, [127 x i8] }
%union.EFI_IP_ADDRESS = type { [4 x i32] }
%struct.EFI_DHCP4_PACKET = type <{ i32, i32, %struct.anon }>
%struct.anon = type <{ %struct.EFI_DHCP4_HEADER, i32, [1 x i8] }>
%struct.EFI_DHCP4_HEADER = type { i8, i8, i8, i8, i32, i16, i16, %struct.EFI_IPv4_ADDRESS, %struct.EFI_IPv4_ADDRESS, %struct.EFI_IPv4_ADDRESS, %struct.EFI_IPv4_ADDRESS, [16 x i8], [64 x i8], [128 x i8] }
%struct.EFI_MAC_ADDRESS = type { [32 x i8] }
%struct.PXEBC_CACHED_DHCP4_PACKET = type { %union.PXEBC_DHCP4_PACKET, i8, i8, [7 x ptr], %struct.PXEBC_VENDOR_OPTION }
%union.PXEBC_DHCP4_PACKET = type { [1480 x i8] }
%struct.PXEBC_VENDOR_OPTION = type { [8 x i32], %struct.EFI_IPv4_ADDRESS, i16, i16, i8, i8, i8, %struct.EFI_IPv4_ADDRESS, %struct.EFI_IPv4_ADDRESS, i16, i16, i16, i16, ptr, i8, ptr, i8, ptr, i8, ptr, i8 }
%struct.EFI_IP4_COMPLETION_TOKEN = type { ptr, i64, %union.anon.1 }
%union.anon.1 = type { ptr }
%struct.EFI_DHCP4_PACKET_OPTION = type { i8, i8, [1 x i8] }
%struct.PXEBC_OPTION_BOOT_ITEM = type { i16, i16 }
%struct._EFI_DHCP4_PROTOCOL = type { ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr }
%struct.EFI_PXE_BASE_CODE_SRVLIST = type { i16, i8, i8, %union.EFI_IP_ADDRESS }

@.str = external hidden unnamed_addr constant [157 x i8], align 1
@.str.12 = external hidden unnamed_addr constant [22 x i8], align 1

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #0

declare ptr @ZeroMem(ptr noundef, i64 noundef) #1

declare ptr @CopyMem(ptr noundef, ptr noundef, i64 noundef) #1

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: nounwind uwtable
declare dso_local void @PxeBcCopyEfiDhcp4Packet(ptr noundef, ptr noundef) #2

declare zeroext i8 @DebugAssertEnabled() #1

declare void @DebugAssert(ptr noundef, i64 noundef, ptr noundef) #1

declare i64 @CompareMem(ptr noundef, ptr noundef, i64 noundef) #1

; Function Attrs: nounwind uwtable
define dso_local i64 @PxeBcDiscvBootService(ptr noundef %0, i16 noundef zeroext %1, ptr noundef %2, i8 noundef zeroext %3, ptr noundef %4, i16 noundef zeroext %5, ptr noundef %6, i8 noundef zeroext %7, ptr noundef %8) #2 {
  %10 = alloca i64, align 8
  %11 = alloca ptr, align 8
  %12 = alloca i16, align 2
  %13 = alloca ptr, align 8
  %14 = alloca i8, align 1
  %15 = alloca ptr, align 8
  %16 = alloca i16, align 2
  %17 = alloca ptr, align 8
  %18 = alloca i8, align 1
  %19 = alloca ptr, align 8
  %20 = alloca i16, align 2
  %21 = alloca ptr, align 8
  %22 = alloca ptr, align 8
  %23 = alloca %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, align 8
  %24 = alloca i8, align 1
  %25 = alloca i64, align 8
  %26 = alloca i16, align 2
  %27 = alloca i16, align 2
  %28 = alloca i16, align 2
  %29 = alloca %struct.EFI_DHCP4_LISTEN_POINT, align 2
  %30 = alloca ptr, align 8
  %31 = alloca [16 x ptr], align 16
  %32 = alloca i32, align 4
  %33 = alloca ptr, align 8
  %34 = alloca ptr, align 8
  %35 = alloca i8, align 1
  %36 = alloca ptr, align 8
  %37 = alloca i32, align 4
  %38 = alloca i32, align 4
  store ptr %0, ptr %11, align 8, !tbaa !5
  store i16 %1, ptr %12, align 2, !tbaa !9
  store ptr %2, ptr %13, align 8, !tbaa !5
  store i8 %3, ptr %14, align 1, !tbaa !11
  store ptr %4, ptr %15, align 8, !tbaa !5
  store i16 %5, ptr %16, align 2, !tbaa !9
  store ptr %6, ptr %17, align 8, !tbaa !5
  store i8 %7, ptr %18, align 1, !tbaa !11
  store ptr %8, ptr %19, align 8, !tbaa !5
  call void @llvm.lifetime.start.p0(i64 2, ptr %20) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %21) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %22) #3
  call void @llvm.lifetime.start.p0(i64 72, ptr %23) #3
  call void @llvm.lifetime.start.p0(i64 1, ptr %24) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %25) #3
  call void @llvm.lifetime.start.p0(i64 2, ptr %26) #3
  call void @llvm.lifetime.start.p0(i64 2, ptr %27) #3
  call void @llvm.lifetime.start.p0(i64 2, ptr %28) #3
  call void @llvm.lifetime.start.p0(i64 10, ptr %29) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %30) #3
  call void @llvm.lifetime.start.p0(i64 128, ptr %31) #3
  call void @llvm.lifetime.start.p0(i64 4, ptr %32) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %33) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %34) #3
  call void @llvm.lifetime.start.p0(i64 1, ptr %35) #3
  call void @llvm.lifetime.start.p0(i64 8, ptr %36) #3
  call void @llvm.lifetime.start.p0(i64 4, ptr %37) #3
  %39 = load ptr, ptr %11, align 8, !tbaa !5
  %40 = getelementptr inbounds %struct._PXEBC_PRIVATE_DATA, ptr %39, i32 0, i32 10
  %41 = getelementptr inbounds %struct._EFI_PXE_BASE_CODE_PROTOCOL, ptr %40, i32 0, i32 13
  %42 = load ptr, ptr %41, align 8, !tbaa !12
  store ptr %42, ptr %21, align 8, !tbaa !5
  %43 = load ptr, ptr %11, align 8, !tbaa !5
  %44 = getelementptr inbounds %struct._PXEBC_PRIVATE_DATA, ptr %43, i32 0, i32 15
  %45 = load ptr, ptr %44, align 8, !tbaa !32
  store ptr %45, ptr %22, align 8, !tbaa !5
  store i64 0, ptr %25, align 8, !tbaa !33
  %46 = call ptr @ZeroMem(ptr noundef %23, i64 noundef 72)
  %47 = load ptr, ptr %15, align 8, !tbaa !5
  %48 = icmp eq ptr %47, null
  br i1 %48, label %49, label %50

49:                                               ; preds = %9
  store i16 67, ptr %20, align 2, !tbaa !9
  store i8 1, ptr %24, align 1, !tbaa !11
  br label %51

50:                                               ; preds = %9
  store i16 4011, ptr %20, align 2, !tbaa !9
  store i8 0, ptr %24, align 1, !tbaa !11
  br label %51

51:                                               ; preds = %50, %49
  %52 = load i8, ptr %14, align 1, !tbaa !11
  %53 = icmp ne i8 %52, 0
  br i1 %53, label %63, label %54

54:                                               ; preds = %51
  %55 = load ptr, ptr %13, align 8, !tbaa !5
  %56 = icmp ne ptr %55, null
  br i1 %56, label %57, label %63

57:                                               ; preds = %54
  %58 = load ptr, ptr %13, align 8, !tbaa !5
  %59 = load i16, ptr %58, align 2, !tbaa !9
  %60 = zext i16 %59 to i32
  %61 = and i32 %60, 32767
  %62 = trunc i32 %61 to i16
  store i16 %62, ptr %58, align 2, !tbaa !9
  br label %63

63:                                               ; preds = %57, %54, %51
  %64 = load ptr, ptr %11, align 8, !tbaa !5
  %65 = getelementptr inbounds [16 x ptr], ptr %31, i64 0, i64 0
  %66 = call i32 @PxeBcBuildDhcpOptions(ptr noundef %64, ptr noundef %65, i8 noundef zeroext 0)
  store i32 %66, ptr %32, align 4, !tbaa !34
  %67 = load i8, ptr %18, align 1, !tbaa !11
  %68 = icmp ne i8 %67, 0
  br i1 %68, label %69, label %139

69:                                               ; preds = %63
  br label %70

70:                                               ; preds = %69
  %71 = call zeroext i8 @DebugAssertEnabled()
  %72 = icmp ne i8 %71, 0
  br i1 %72, label %73, label %78

73:                                               ; preds = %70
  %74 = load ptr, ptr %13, align 8, !tbaa !5
  %75 = icmp ne ptr %74, null
  br i1 %75, label %77, label %76

76:                                               ; preds = %73
  call void @DebugAssert(ptr noundef @.str, i64 noundef 1171, ptr noundef @.str.12)
  br label %77

77:                                               ; preds = %76, %73
  br label %78

78:                                               ; preds = %77, %70
  br label %79

79:                                               ; preds = %78
  br label %80

80:                                               ; preds = %79
  store i8 9, ptr %35, align 1, !tbaa !11
  %81 = load i8, ptr %35, align 1, !tbaa !11
  %82 = zext i8 %81 to i64
  %83 = call ptr @AllocatePool(i64 noundef %82)
  %84 = load i32, ptr %32, align 4, !tbaa !34
  %85 = zext i32 %84 to i64
  %86 = getelementptr inbounds [16 x ptr], ptr %31, i64 0, i64 %85
  store ptr %83, ptr %86, align 8, !tbaa !5
  %87 = load i32, ptr %32, align 4, !tbaa !34
  %88 = zext i32 %87 to i64
  %89 = getelementptr inbounds [16 x ptr], ptr %31, i64 0, i64 %88
  %90 = load ptr, ptr %89, align 8, !tbaa !5
  %91 = icmp eq ptr %90, null
  br i1 %91, label %92, label %93

92:                                               ; preds = %80
  store i64 -9223372036854775799, ptr %10, align 8
  store i32 1, ptr %38, align 4
  br label %428

93:                                               ; preds = %80
  %94 = load i32, ptr %32, align 4, !tbaa !34
  %95 = zext i32 %94 to i64
  %96 = getelementptr inbounds [16 x ptr], ptr %31, i64 0, i64 %95
  %97 = load ptr, ptr %96, align 8, !tbaa !5
  %98 = getelementptr inbounds %struct.EFI_DHCP4_PACKET_OPTION, ptr %97, i32 0, i32 0
  store i8 43, ptr %98, align 1, !tbaa !35
  %99 = load i8, ptr %35, align 1, !tbaa !11
  %100 = zext i8 %99 to i32
  %101 = sub nsw i32 %100, 2
  %102 = trunc i32 %101 to i8
  %103 = load i32, ptr %32, align 4, !tbaa !34
  %104 = zext i32 %103 to i64
  %105 = getelementptr inbounds [16 x ptr], ptr %31, i64 0, i64 %104
  %106 = load ptr, ptr %105, align 8, !tbaa !5
  %107 = getelementptr inbounds %struct.EFI_DHCP4_PACKET_OPTION, ptr %106, i32 0, i32 1
  store i8 %102, ptr %107, align 1, !tbaa !37
  %108 = load i32, ptr %32, align 4, !tbaa !34
  %109 = zext i32 %108 to i64
  %110 = getelementptr inbounds [16 x ptr], ptr %31, i64 0, i64 %109
  %111 = load ptr, ptr %110, align 8, !tbaa !5
  %112 = getelementptr inbounds %struct.EFI_DHCP4_PACKET_OPTION, ptr %111, i32 0, i32 2
  %113 = getelementptr inbounds [1 x i8], ptr %112, i64 0, i64 0
  store ptr %113, ptr %33, align 8, !tbaa !5
  %114 = load ptr, ptr %33, align 8, !tbaa !5
  %115 = getelementptr inbounds %struct.EFI_DHCP4_PACKET_OPTION, ptr %114, i32 0, i32 0
  store i8 71, ptr %115, align 1, !tbaa !35
  %116 = load ptr, ptr %33, align 8, !tbaa !5
  %117 = getelementptr inbounds %struct.EFI_DHCP4_PACKET_OPTION, ptr %116, i32 0, i32 1
  store i8 4, ptr %117, align 1, !tbaa !37
  %118 = load ptr, ptr %33, align 8, !tbaa !5
  %119 = getelementptr inbounds %struct.EFI_DHCP4_PACKET_OPTION, ptr %118, i32 0, i32 2
  %120 = getelementptr inbounds [1 x i8], ptr %119, i64 0, i64 0
  store ptr %120, ptr %34, align 8, !tbaa !5
  %121 = load i16, ptr %12, align 2, !tbaa !9
  %122 = call zeroext i16 @SwapBytes16(i16 noundef zeroext %121)
  %123 = load ptr, ptr %34, align 8, !tbaa !5
  %124 = getelementptr inbounds %struct.PXEBC_OPTION_BOOT_ITEM, ptr %123, i32 0, i32 0
  store i16 %122, ptr %124, align 1, !tbaa !38
  %125 = load ptr, ptr %13, align 8, !tbaa !5
  %126 = load i16, ptr %125, align 2, !tbaa !9
  %127 = call zeroext i16 @SwapBytes16(i16 noundef zeroext %126)
  %128 = load ptr, ptr %34, align 8, !tbaa !5
  %129 = getelementptr inbounds %struct.PXEBC_OPTION_BOOT_ITEM, ptr %128, i32 0, i32 1
  store i16 %127, ptr %129, align 1, !tbaa !40
  %130 = load ptr, ptr %33, align 8, !tbaa !5
  %131 = getelementptr inbounds %struct.EFI_DHCP4_PACKET_OPTION, ptr %130, i32 0, i32 2
  %132 = load ptr, ptr %33, align 8, !tbaa !5
  %133 = getelementptr inbounds %struct.EFI_DHCP4_PACKET_OPTION, ptr %132, i32 0, i32 1
  %134 = load i8, ptr %133, align 1, !tbaa !37
  %135 = zext i8 %134 to i64
  %136 = getelementptr inbounds [1 x i8], ptr %131, i64 0, i64 %135
  store i8 -1, ptr %136, align 1, !tbaa !11
  %137 = load i32, ptr %32, align 4, !tbaa !34
  %138 = add i32 %137, 1
  store i32 %138, ptr %32, align 4, !tbaa !34
  br label %139

139:                                              ; preds = %93, %63
  %140 = load ptr, ptr %22, align 8, !tbaa !5
  %141 = getelementptr inbounds %struct._EFI_DHCP4_PROTOCOL, ptr %140, i32 0, i32 6
  %142 = load ptr, ptr %141, align 8, !tbaa !41
  %143 = load ptr, ptr %22, align 8, !tbaa !5
  %144 = load ptr, ptr %11, align 8, !tbaa !5
  %145 = getelementptr inbounds %struct._PXEBC_PRIVATE_DATA, ptr %144, i32 0, i32 35
  %146 = load i32, ptr %32, align 4, !tbaa !34
  %147 = getelementptr inbounds [16 x ptr], ptr %31, i64 0, i64 0
  %148 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %149 = call i64 %142(ptr noundef %143, ptr noundef %145, i32 noundef 0, ptr noundef null, i32 noundef %146, ptr noundef %147, ptr noundef %148)
  store i64 %149, ptr %25, align 8, !tbaa !33
  %150 = load i8, ptr %18, align 1, !tbaa !11
  %151 = icmp ne i8 %150, 0
  br i1 %151, label %152, label %158

152:                                              ; preds = %139
  %153 = load i32, ptr %32, align 4, !tbaa !34
  %154 = sub i32 %153, 1
  %155 = zext i32 %154 to i64
  %156 = getelementptr inbounds [16 x ptr], ptr %31, i64 0, i64 %155
  %157 = load ptr, ptr %156, align 8, !tbaa !5
  call void @FreePool(ptr noundef %157)
  br label %158

158:                                              ; preds = %152, %139
  %159 = load i64, ptr %25, align 8, !tbaa !33
  %160 = icmp slt i64 %159, 0
  br i1 %160, label %161, label %163

161:                                              ; preds = %158
  %162 = load i64, ptr %25, align 8, !tbaa !33
  store i64 %162, ptr %10, align 8
  store i32 1, ptr %38, align 4
  br label %428

163:                                              ; preds = %158
  %164 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %165 = load ptr, ptr %164, align 8, !tbaa !43
  %166 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %165, i32 0, i32 2
  %167 = getelementptr inbounds %struct.anon, ptr %166, i32 0, i32 0
  store ptr %167, ptr %36, align 8, !tbaa !5
  %168 = load ptr, ptr %21, align 8, !tbaa !5
  %169 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_MODE, ptr %168, i32 0, i32 7
  %170 = load i8, ptr %169, align 1, !tbaa !45
  %171 = icmp ne i8 %170, 0
  br i1 %171, label %172, label %186

172:                                              ; preds = %163
  %173 = load ptr, ptr %36, align 8, !tbaa !5
  %174 = getelementptr inbounds %struct.EFI_DHCP4_HEADER, ptr %173, i32 0, i32 11
  %175 = getelementptr inbounds [16 x i8], ptr %174, i64 0, i64 0
  %176 = call i64 @NetLibGetSystemGuid(ptr noundef %175)
  %177 = icmp slt i64 %176, 0
  br i1 %177, label %178, label %183

178:                                              ; preds = %172
  %179 = load ptr, ptr %36, align 8, !tbaa !5
  %180 = getelementptr inbounds %struct.EFI_DHCP4_HEADER, ptr %179, i32 0, i32 11
  %181 = getelementptr inbounds [16 x i8], ptr %180, i64 0, i64 0
  %182 = call ptr @ZeroMem(ptr noundef %181, i64 noundef 16)
  br label %183

183:                                              ; preds = %178, %172
  %184 = load ptr, ptr %36, align 8, !tbaa !5
  %185 = getelementptr inbounds %struct.EFI_DHCP4_HEADER, ptr %184, i32 0, i32 2
  store i8 16, ptr %185, align 1, !tbaa !46
  br label %186

186:                                              ; preds = %183, %163
  %187 = call i32 @NetRandomInitSeed()
  %188 = zext i32 %187 to i64
  %189 = mul i64 %188, 1103515245
  %190 = add i64 %189, 12345
  %191 = trunc i64 %190 to i32
  %192 = zext i32 %191 to i64
  %193 = urem i64 %192, 4294967295
  %194 = trunc i64 %193 to i32
  store i32 %194, ptr %37, align 4, !tbaa !34
  %195 = load i32, ptr %37, align 4, !tbaa !34
  %196 = call i32 @SwapBytes32(i32 noundef %195)
  %197 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %198 = load ptr, ptr %197, align 8, !tbaa !43
  %199 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %198, i32 0, i32 2
  %200 = getelementptr inbounds %struct.anon, ptr %199, i32 0, i32 0
  %201 = getelementptr inbounds %struct.EFI_DHCP4_HEADER, ptr %200, i32 0, i32 4
  store i32 %196, ptr %201, align 1, !tbaa !47
  %202 = load i8, ptr %24, align 1, !tbaa !11
  %203 = zext i8 %202 to i32
  %204 = icmp ne i32 %203, 0
  %205 = zext i1 %204 to i64
  %206 = select i1 %204, i32 32768, i32 0
  %207 = trunc i32 %206 to i16
  %208 = call zeroext i16 @SwapBytes16(i16 noundef zeroext %207)
  %209 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %210 = load ptr, ptr %209, align 8, !tbaa !43
  %211 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %210, i32 0, i32 2
  %212 = getelementptr inbounds %struct.anon, ptr %211, i32 0, i32 0
  %213 = getelementptr inbounds %struct.EFI_DHCP4_HEADER, ptr %212, i32 0, i32 6
  store i16 %208, ptr %213, align 1, !tbaa !48
  %214 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %215 = load ptr, ptr %214, align 8, !tbaa !43
  %216 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %215, i32 0, i32 2
  %217 = getelementptr inbounds %struct.anon, ptr %216, i32 0, i32 0
  %218 = getelementptr inbounds %struct.EFI_DHCP4_HEADER, ptr %217, i32 0, i32 7
  %219 = load ptr, ptr %11, align 8, !tbaa !5
  %220 = getelementptr inbounds %struct._PXEBC_PRIVATE_DATA, ptr %219, i32 0, i32 26
  %221 = call ptr @CopyMem(ptr noundef %218, ptr noundef %220, i64 noundef 4)
  %222 = load i16, ptr %20, align 2, !tbaa !9
  %223 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 3
  store i16 %222, ptr %223, align 4, !tbaa !49
  %224 = load i8, ptr %24, align 1, !tbaa !11
  %225 = icmp ne i8 %224, 0
  br i1 %225, label %226, label %229

226:                                              ; preds = %186
  %227 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 2
  %228 = call ptr @SetMem(ptr noundef %227, i64 noundef 4, i8 noundef zeroext -1)
  br label %233

229:                                              ; preds = %186
  %230 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 2
  %231 = load ptr, ptr %15, align 8, !tbaa !5
  %232 = call ptr @CopyMem(ptr noundef %230, ptr noundef %231, i64 noundef 4)
  br label %233

233:                                              ; preds = %229, %226
  %234 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 4
  %235 = load ptr, ptr %11, align 8, !tbaa !5
  %236 = getelementptr inbounds %struct._PXEBC_PRIVATE_DATA, ptr %235, i32 0, i32 28
  %237 = call ptr @CopyMem(ptr noundef %234, ptr noundef %236, i64 noundef 4)
  %238 = load i8, ptr %24, align 1, !tbaa !11
  %239 = icmp ne i8 %238, 0
  br i1 %239, label %261, label %240

240:                                              ; preds = %233
  %241 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 5
  store i32 1, ptr %241, align 4, !tbaa !50
  %242 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 6
  store ptr %29, ptr %242, align 8, !tbaa !51
  %243 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 6
  %244 = load ptr, ptr %243, align 8, !tbaa !51
  %245 = getelementptr inbounds %struct.EFI_DHCP4_LISTEN_POINT, ptr %244, i64 0
  %246 = getelementptr inbounds %struct.EFI_DHCP4_LISTEN_POINT, ptr %245, i32 0, i32 2
  store i16 4011, ptr %246, align 2, !tbaa !52
  %247 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 6
  %248 = load ptr, ptr %247, align 8, !tbaa !51
  %249 = getelementptr inbounds %struct.EFI_DHCP4_LISTEN_POINT, ptr %248, i64 0
  %250 = getelementptr inbounds %struct.EFI_DHCP4_LISTEN_POINT, ptr %249, i32 0, i32 0
  %251 = load ptr, ptr %11, align 8, !tbaa !5
  %252 = getelementptr inbounds %struct._PXEBC_PRIVATE_DATA, ptr %251, i32 0, i32 26
  %253 = call ptr @CopyMem(ptr noundef %250, ptr noundef %252, i64 noundef 4)
  %254 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 6
  %255 = load ptr, ptr %254, align 8, !tbaa !51
  %256 = getelementptr inbounds %struct.EFI_DHCP4_LISTEN_POINT, ptr %255, i64 0
  %257 = getelementptr inbounds %struct.EFI_DHCP4_LISTEN_POINT, ptr %256, i32 0, i32 1
  %258 = load ptr, ptr %11, align 8, !tbaa !5
  %259 = getelementptr inbounds %struct._PXEBC_PRIVATE_DATA, ptr %258, i32 0, i32 27
  %260 = call ptr @CopyMem(ptr noundef %257, ptr noundef %259, i64 noundef 4)
  br label %261

261:                                              ; preds = %240, %233
  store i16 1, ptr %28, align 2, !tbaa !9
  br label %262

262:                                              ; preds = %293, %261
  %263 = load i16, ptr %28, align 2, !tbaa !9
  %264 = zext i16 %263 to i32
  %265 = icmp sle i32 %264, 4
  br i1 %265, label %266, label %296

266:                                              ; preds = %262
  %267 = load i16, ptr %28, align 2, !tbaa !9
  %268 = zext i16 %267 to i32
  %269 = mul nsw i32 1, %268
  %270 = trunc i32 %269 to i16
  %271 = zext i16 %270 to i32
  %272 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 7
  store i32 %271, ptr %272, align 8, !tbaa !54
  %273 = load i16, ptr %28, align 2, !tbaa !9
  %274 = zext i16 %273 to i32
  %275 = sub nsw i32 %274, 1
  %276 = mul nsw i32 1, %275
  %277 = trunc i32 %276 to i16
  %278 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %279 = load ptr, ptr %278, align 8, !tbaa !43
  %280 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %279, i32 0, i32 2
  %281 = getelementptr inbounds %struct.anon, ptr %280, i32 0, i32 0
  %282 = getelementptr inbounds %struct.EFI_DHCP4_HEADER, ptr %281, i32 0, i32 5
  store i16 %277, ptr %282, align 1, !tbaa !55
  %283 = load ptr, ptr %22, align 8, !tbaa !5
  %284 = getelementptr inbounds %struct._EFI_DHCP4_PROTOCOL, ptr %283, i32 0, i32 7
  %285 = load ptr, ptr %284, align 8, !tbaa !56
  %286 = load ptr, ptr %22, align 8, !tbaa !5
  %287 = call i64 %285(ptr noundef %286, ptr noundef %23)
  store i64 %287, ptr %25, align 8, !tbaa !33
  %288 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 0
  %289 = load i64, ptr %288, align 8, !tbaa !57
  %290 = icmp ne i64 %289, -9223372036854775790
  br i1 %290, label %291, label %292

291:                                              ; preds = %266
  br label %296

292:                                              ; preds = %266
  br label %293

293:                                              ; preds = %292
  %294 = load i16, ptr %28, align 2, !tbaa !9
  %295 = add i16 %294, 1
  store i16 %295, ptr %28, align 2, !tbaa !9
  br label %262, !llvm.loop !58

296:                                              ; preds = %291, %262
  %297 = load i16, ptr %28, align 2, !tbaa !9
  %298 = zext i16 %297 to i32
  %299 = icmp sgt i32 %298, 4
  br i1 %299, label %300, label %301

300:                                              ; preds = %296
  store i64 -9223372036854775790, ptr %25, align 8, !tbaa !33
  br label %301

301:                                              ; preds = %300, %296
  %302 = load i64, ptr %25, align 8, !tbaa !33
  %303 = icmp slt i64 %302, 0
  br i1 %303, label %424, label %304

304:                                              ; preds = %301
  store i16 0, ptr %26, align 2, !tbaa !9
  store i16 0, ptr %27, align 2, !tbaa !9
  %305 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 10
  %306 = load ptr, ptr %305, align 8, !tbaa !60
  store ptr %306, ptr %30, align 8, !tbaa !5
  br label %307

307:                                              ; preds = %364, %304
  %308 = load i16, ptr %26, align 2, !tbaa !9
  %309 = zext i16 %308 to i32
  %310 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 9
  %311 = load i32, ptr %310, align 8, !tbaa !61
  %312 = icmp ult i32 %309, %311
  br i1 %312, label %313, label %373

313:                                              ; preds = %307
  br label %314

314:                                              ; preds = %350, %313
  %315 = load i16, ptr %27, align 2, !tbaa !9
  %316 = zext i16 %315 to i32
  %317 = load i16, ptr %16, align 2, !tbaa !9
  %318 = zext i16 %317 to i32
  %319 = icmp slt i32 %316, %318
  br i1 %319, label %320, label %353

320:                                              ; preds = %314
  %321 = load ptr, ptr %17, align 8, !tbaa !5
  %322 = load i16, ptr %27, align 2, !tbaa !9
  %323 = zext i16 %322 to i64
  %324 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_SRVLIST, ptr %321, i64 %323
  %325 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_SRVLIST, ptr %324, i32 0, i32 1
  %326 = load i8, ptr %325, align 2, !tbaa !62
  %327 = icmp ne i8 %326, 0
  br i1 %327, label %328, label %329

328:                                              ; preds = %320
  br label %353

329:                                              ; preds = %320
  %330 = load ptr, ptr %17, align 8, !tbaa !5
  %331 = load i16, ptr %27, align 2, !tbaa !9
  %332 = zext i16 %331 to i64
  %333 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_SRVLIST, ptr %330, i64 %332
  %334 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_SRVLIST, ptr %333, i32 0, i32 0
  %335 = load i16, ptr %334, align 4, !tbaa !64
  %336 = zext i16 %335 to i32
  %337 = load i16, ptr %12, align 2, !tbaa !9
  %338 = zext i16 %337 to i32
  %339 = icmp eq i32 %336, %338
  br i1 %339, label %340, label %350

340:                                              ; preds = %329
  %341 = load ptr, ptr %30, align 8, !tbaa !5
  %342 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %341, i32 0, i32 2
  %343 = getelementptr inbounds %struct.anon, ptr %342, i32 0, i32 0
  %344 = getelementptr inbounds %struct.EFI_DHCP4_HEADER, ptr %343, i32 0, i32 9
  %345 = load ptr, ptr %11, align 8, !tbaa !5
  %346 = getelementptr inbounds %struct._PXEBC_PRIVATE_DATA, ptr %345, i32 0, i32 29
  %347 = call i64 @CompareMem(ptr noundef %344, ptr noundef %346, i64 noundef 4)
  %348 = icmp eq i64 %347, 0
  br i1 %348, label %349, label %350

349:                                              ; preds = %340
  br label %353

350:                                              ; preds = %340, %329
  %351 = load i16, ptr %27, align 2, !tbaa !9
  %352 = add i16 %351, 1
  store i16 %352, ptr %27, align 2, !tbaa !9
  br label %314, !llvm.loop !65

353:                                              ; preds = %349, %328, %314
  %354 = load i16, ptr %16, align 2, !tbaa !9
  %355 = zext i16 %354 to i32
  %356 = load i16, ptr %27, align 2, !tbaa !9
  %357 = zext i16 %356 to i32
  %358 = icmp ne i32 %355, %357
  br i1 %358, label %363, label %359

359:                                              ; preds = %353
  %360 = load i16, ptr %16, align 2, !tbaa !9
  %361 = zext i16 %360 to i32
  %362 = icmp eq i32 %361, 0
  br i1 %362, label %363, label %364

363:                                              ; preds = %359, %353
  br label %373

364:                                              ; preds = %359
  store i16 0, ptr %27, align 2, !tbaa !9
  %365 = load i16, ptr %26, align 2, !tbaa !9
  %366 = add i16 %365, 1
  store i16 %366, ptr %26, align 2, !tbaa !9
  %367 = load ptr, ptr %30, align 8, !tbaa !5
  %368 = load ptr, ptr %30, align 8, !tbaa !5
  %369 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %368, i32 0, i32 0
  %370 = load i32, ptr %369, align 1, !tbaa !66
  %371 = zext i32 %370 to i64
  %372 = getelementptr inbounds i8, ptr %367, i64 %371
  store ptr %372, ptr %30, align 8, !tbaa !5
  br label %307, !llvm.loop !67

373:                                              ; preds = %363, %307
  %374 = load i16, ptr %26, align 2, !tbaa !9
  %375 = zext i16 %374 to i32
  %376 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 9
  %377 = load i32, ptr %376, align 8, !tbaa !61
  %378 = icmp ult i32 %375, %377
  br i1 %378, label %379, label %415

379:                                              ; preds = %373
  %380 = load ptr, ptr %19, align 8, !tbaa !5
  %381 = icmp ne ptr %380, null
  br i1 %381, label %382, label %385

382:                                              ; preds = %379
  %383 = load ptr, ptr %19, align 8, !tbaa !5
  %384 = load ptr, ptr %30, align 8, !tbaa !5
  call void @PxeBcCopyEfiDhcp4Packet(ptr noundef %383, ptr noundef %384)
  br label %385

385:                                              ; preds = %382, %379
  %386 = load i8, ptr %18, align 1, !tbaa !11
  %387 = icmp ne i8 %386, 0
  br i1 %387, label %388, label %414

388:                                              ; preds = %385
  %389 = load ptr, ptr %21, align 8, !tbaa !5
  %390 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_MODE, ptr %389, i32 0, i32 24
  %391 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %392 = load ptr, ptr %391, align 8, !tbaa !43
  %393 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %392, i32 0, i32 2
  %394 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %395 = load ptr, ptr %394, align 8, !tbaa !43
  %396 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %395, i32 0, i32 1
  %397 = load i32, ptr %396, align 1, !tbaa !68
  %398 = zext i32 %397 to i64
  %399 = call ptr @CopyMem(ptr noundef %390, ptr noundef %393, i64 noundef %398)
  %400 = load ptr, ptr %21, align 8, !tbaa !5
  %401 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_MODE, ptr %400, i32 0, i32 11
  store i8 1, ptr %401, align 1, !tbaa !69
  %402 = load ptr, ptr %21, align 8, !tbaa !5
  %403 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_MODE, ptr %402, i32 0, i32 25
  %404 = getelementptr inbounds [1472 x i8], ptr %403, i64 0, i64 0
  %405 = load ptr, ptr %30, align 8, !tbaa !5
  %406 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %405, i32 0, i32 2
  %407 = load ptr, ptr %30, align 8, !tbaa !5
  %408 = getelementptr inbounds %struct.EFI_DHCP4_PACKET, ptr %407, i32 0, i32 1
  %409 = load i32, ptr %408, align 1, !tbaa !68
  %410 = zext i32 %409 to i64
  %411 = call ptr @CopyMem(ptr noundef %404, ptr noundef %406, i64 noundef %410)
  %412 = load ptr, ptr %21, align 8, !tbaa !5
  %413 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_MODE, ptr %412, i32 0, i32 12
  store i8 1, ptr %413, align 4, !tbaa !70
  br label %414

414:                                              ; preds = %388, %385
  br label %416

415:                                              ; preds = %373
  store i64 -9223372036854775794, ptr %25, align 8, !tbaa !33
  br label %416

416:                                              ; preds = %415, %414
  %417 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 10
  %418 = load ptr, ptr %417, align 8, !tbaa !60
  %419 = icmp ne ptr %418, null
  br i1 %419, label %420, label %423

420:                                              ; preds = %416
  %421 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 10
  %422 = load ptr, ptr %421, align 8, !tbaa !60
  call void @FreePool(ptr noundef %422)
  br label %423

423:                                              ; preds = %420, %416
  br label %424

424:                                              ; preds = %423, %301
  %425 = getelementptr inbounds %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, ptr %23, i32 0, i32 8
  %426 = load ptr, ptr %425, align 8, !tbaa !43
  call void @FreePool(ptr noundef %426)
  %427 = load i64, ptr %25, align 8, !tbaa !33
  store i64 %427, ptr %10, align 8
  store i32 1, ptr %38, align 4
  br label %428

428:                                              ; preds = %424, %161, %92
  call void @llvm.lifetime.end.p0(i64 4, ptr %37) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %36) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %35) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %34) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %33) #3
  call void @llvm.lifetime.end.p0(i64 4, ptr %32) #3
  call void @llvm.lifetime.end.p0(i64 128, ptr %31) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %30) #3
  call void @llvm.lifetime.end.p0(i64 10, ptr %29) #3
  call void @llvm.lifetime.end.p0(i64 2, ptr %28) #3
  call void @llvm.lifetime.end.p0(i64 2, ptr %27) #3
  call void @llvm.lifetime.end.p0(i64 2, ptr %26) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %25) #3
  call void @llvm.lifetime.end.p0(i64 1, ptr %24) #3
  call void @llvm.lifetime.end.p0(i64 72, ptr %23) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %22) #3
  call void @llvm.lifetime.end.p0(i64 8, ptr %21) #3
  call void @llvm.lifetime.end.p0(i64 2, ptr %20) #3
  %429 = load i64, ptr %10, align 8
  ret i64 %429
}

declare zeroext i16 @SwapBytes16(i16 noundef zeroext) #1

declare i64 @NetLibGetSystemGuid(ptr noundef) #1

; Function Attrs: nounwind uwtable
declare dso_local i32 @PxeBcBuildDhcpOptions(ptr noundef, ptr noundef, i8 noundef zeroext) #2

declare ptr @AllocatePool(i64 noundef) #1

declare void @FreePool(ptr noundef) #1

declare i32 @NetRandomInitSeed() #1

declare i32 @SwapBytes32(i32 noundef) #1

declare ptr @SetMem(ptr noundef, i64 noundef, i8 noundef zeroext) #1

attributes #0 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #1 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #2 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !10, i64 0}
!10 = !{!"short", !7, i64 0}
!11 = !{!7, !7, i64 0}
!12 = !{!13, !6, i64 184}
!13 = !{!"_PXEBC_PRIVATE_DATA", !14, i64 0, !6, i64 8, !6, i64 16, !6, i64 24, !6, i64 32, !6, i64 40, !6, i64 48, !6, i64 56, !6, i64 64, !6, i64 72, !15, i64 80, !17, i64 192, !18, i64 200, !6, i64 216, !6, i64 224, !6, i64 232, !6, i64 240, !19, i64 248, !6, i64 280, !6, i64 288, !6, i64 296, !10, i64 304, !21, i64 308, !22, i64 344, !14, i64 10768, !6, i64 10776, !7, i64 10784, !7, i64 10800, !7, i64 10816, !7, i64 10832, !7, i64 10848, !14, i64 10852, !16, i64 10856, !16, i64 10864, !7, i64 10872, !26, i64 11184, !20, i64 11433, !7, i64 11465, !7, i64 11466, !7, i64 11467, !14, i64 11468, !14, i64 11472, !14, i64 11476, !29, i64 11480, !29, i64 13152, !29, i64 14824, !7, i64 16496, !7, i64 43248, !7, i64 43268, !14, i64 43588, !7, i64 43592, !7, i64 43612, !6, i64 43680, !31, i64 43688}
!14 = !{!"int", !7, i64 0}
!15 = !{!"_EFI_PXE_BASE_CODE_PROTOCOL", !16, i64 0, !6, i64 8, !6, i64 16, !6, i64 24, !6, i64 32, !6, i64 40, !6, i64 48, !6, i64 56, !6, i64 64, !6, i64 72, !6, i64 80, !6, i64 88, !6, i64 96, !6, i64 104}
!16 = !{!"long long", !7, i64 0}
!17 = !{!"_EFI_LOAD_FILE_PROTOCOL", !6, i64 0}
!18 = !{!"_EFI_PXE_BASE_CODE_CALLBACK_PROTOCOL", !16, i64 0, !6, i64 8}
!19 = !{!"", !7, i64 0, !7, i64 1, !7, i64 2, !7, i64 3, !7, i64 4, !7, i64 5, !20, i64 6, !20, i64 10, !7, i64 14, !7, i64 15, !7, i64 16, !7, i64 17, !14, i64 20, !14, i64 24}
!20 = !{!"", !7, i64 0}
!21 = !{!"", !7, i64 0, !7, i64 1, !7, i64 2, !7, i64 3, !7, i64 4, !7, i64 5, !7, i64 6, !14, i64 8, !14, i64 12, !7, i64 16, !20, i64 17, !20, i64 21, !10, i64 26, !20, i64 28, !10, i64 32}
!22 = !{!"", !7, i64 0, !7, i64 1, !7, i64 2, !7, i64 3, !7, i64 4, !7, i64 5, !7, i64 6, !7, i64 7, !7, i64 8, !7, i64 9, !7, i64 10, !7, i64 11, !7, i64 12, !7, i64 13, !7, i64 14, !7, i64 15, !7, i64 16, !7, i64 17, !7, i64 18, !7, i64 20, !7, i64 36, !7, i64 52, !7, i64 1524, !7, i64 2996, !7, i64 4468, !7, i64 5940, !7, i64 7412, !23, i64 8884, !14, i64 9016, !7, i64 9020, !14, i64 9404, !7, i64 9408, !24, i64 9792, !25, i64 10296}
!23 = !{!"", !7, i64 0, !7, i64 1, !10, i64 2, !7, i64 4}
!24 = !{!"", !7, i64 0, !7, i64 1, !10, i64 2, !7, i64 4, !7, i64 8}
!25 = !{!"", !7, i64 0, !7, i64 1}
!26 = !{!"", !14, i64 0, !14, i64 4, !27, i64 8}
!27 = !{!"", !28, i64 0, !14, i64 236, !7, i64 240}
!28 = !{!"", !7, i64 0, !7, i64 1, !7, i64 2, !7, i64 3, !14, i64 4, !10, i64 8, !10, i64 10, !20, i64 12, !20, i64 16, !20, i64 20, !20, i64 24, !7, i64 28, !7, i64 44, !7, i64 108}
!29 = !{!"", !7, i64 0, !7, i64 1480, !7, i64 1481, !7, i64 1488, !30, i64 1544}
!30 = !{!"", !7, i64 0, !20, i64 32, !10, i64 36, !10, i64 38, !7, i64 40, !7, i64 41, !7, i64 42, !20, i64 43, !20, i64 47, !10, i64 52, !10, i64 54, !10, i64 56, !10, i64 58, !6, i64 64, !7, i64 72, !6, i64 80, !7, i64 88, !6, i64 96, !7, i64 104, !6, i64 112, !7, i64 120}
!31 = !{!"", !6, i64 0, !16, i64 8, !7, i64 16}
!32 = !{!13, !6, i64 232}
!33 = !{!16, !16, i64 0}
!34 = !{!14, !14, i64 0}
!35 = !{!36, !7, i64 0}
!36 = !{!"", !7, i64 0, !7, i64 1, !7, i64 2}
!37 = !{!36, !7, i64 1}
!38 = !{!39, !10, i64 0}
!39 = !{!"", !10, i64 0, !10, i64 2}
!40 = !{!39, !10, i64 2}
!41 = !{!42, !6, i64 48}
!42 = !{!"_EFI_DHCP4_PROTOCOL", !6, i64 0, !6, i64 8, !6, i64 16, !6, i64 24, !6, i64 32, !6, i64 40, !6, i64 48, !6, i64 56, !6, i64 64}
!43 = !{!44, !6, i64 48}
!44 = !{!"", !16, i64 0, !6, i64 8, !20, i64 16, !10, i64 20, !20, i64 22, !14, i64 28, !6, i64 32, !14, i64 40, !6, i64 48, !14, i64 56, !6, i64 64}
!45 = !{!22, !7, i64 7}
!46 = !{!28, !7, i64 2}
!47 = !{!26, !14, i64 12}
!48 = !{!26, !10, i64 18}
!49 = !{!44, !10, i64 20}
!50 = !{!44, !14, i64 28}
!51 = !{!44, !6, i64 32}
!52 = !{!53, !10, i64 8}
!53 = !{!"", !20, i64 0, !20, i64 4, !10, i64 8}
!54 = !{!44, !14, i64 40}
!55 = !{!26, !10, i64 16}
!56 = !{!42, !6, i64 56}
!57 = !{!44, !16, i64 0}
!58 = distinct !{!58, !59}
!59 = !{!"llvm.loop.mustprogress"}
!60 = !{!44, !6, i64 64}
!61 = !{!44, !14, i64 56}
!62 = !{!63, !7, i64 2}
!63 = !{!"", !10, i64 0, !7, i64 2, !7, i64 3, !7, i64 4}
!64 = !{!63, !10, i64 0}
!65 = distinct !{!65, !59}
!66 = !{!26, !14, i64 0}
!67 = distinct !{!67, !59}
!68 = !{!26, !14, i64 4}
!69 = !{!22, !7, i64 11}
!70 = !{!22, !7, i64 12}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN = type { i64, ptr, %struct.EFI_IPv4_ADDRESS, i16, %struct.EFI_IPv4_ADDRESS, i32, ptr, i32, ptr, i32, ptr }
%struct.EFI_IPv4_ADDRESS = type { [4 x i8] }
%struct.EFI_DHCP4_LISTEN_POINT = type { %struct.EFI_IPv4_ADDRESS, %struct.EFI_IPv4_ADDRESS, i16 }
%struct.EFI_PXE_BASE_CODE_SRVLIST = type { i16, i8, i8, %union.EFI_IP_ADDRESS }
%union.EFI_IP_ADDRESS = type { [4 x i32] }

@.str = external hidden unnamed_addr constant [157 x i8], align 1
@.str.12 = external hidden unnamed_addr constant [22 x i8], align 1

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #0

declare ptr @ZeroMem(ptr noundef, i64 noundef) local_unnamed_addr #1

declare ptr @CopyMem(ptr noundef, ptr noundef, i64 noundef) local_unnamed_addr #1

; Function Attrs: mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #0

; Function Attrs: nounwind uwtable
declare dso_local void @PxeBcCopyEfiDhcp4Packet(ptr noundef, ptr noundef) local_unnamed_addr #2

declare zeroext i8 @DebugAssertEnabled() local_unnamed_addr #1

declare void @DebugAssert(ptr noundef, i64 noundef, ptr noundef) local_unnamed_addr #1

declare i64 @CompareMem(ptr noundef, ptr noundef, i64 noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
define dso_local i64 @PxeBcDiscvBootService(ptr noundef %0, i16 noundef zeroext %1, ptr noundef %2, i8 noundef zeroext %3, ptr noundef %4, i16 noundef zeroext %5, ptr nocapture noundef readonly %6, i8 noundef zeroext %7, ptr noundef %8) local_unnamed_addr #2 {
  %10 = alloca %struct.EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN, align 8
  %11 = alloca %struct.EFI_DHCP4_LISTEN_POINT, align 2
  %12 = alloca [16 x ptr], align 16
  call void @llvm.lifetime.start.p0(i64 72, ptr nonnull %10) #3
  call void @llvm.lifetime.start.p0(i64 10, ptr nonnull %11) #3
  call void @llvm.lifetime.start.p0(i64 128, ptr nonnull %12) #3
  %13 = getelementptr inbounds i8, ptr %0, i64 184
  %14 = load ptr, ptr %13, align 8, !tbaa !5
  %15 = getelementptr inbounds i8, ptr %0, i64 232
  %16 = load ptr, ptr %15, align 8, !tbaa !29
  %17 = call ptr @ZeroMem(ptr noundef nonnull %10, i64 noundef 72) #3
  %.not111.not = icmp eq ptr %4, null
  %. = select i1 %.not111.not, i16 67, i16 4011
  %18 = icmp eq i8 %3, 0
  %19 = icmp ne ptr %2, null
  %or.cond = and i1 %19, %18
  br i1 %or.cond, label %20, label %23

20:                                               ; preds = %9
  %21 = load i16, ptr %2, align 2, !tbaa !30
  %22 = and i16 %21, 32767
  store i16 %22, ptr %2, align 2, !tbaa !30
  br label %23

23:                                               ; preds = %20, %9
  %24 = call i32 @PxeBcBuildDhcpOptions(ptr noundef nonnull %0, ptr noundef nonnull %12, i8 noundef zeroext 0)
  %.not = icmp eq i8 %7, 0
  br i1 %.not, label %.thread, label %30

.thread:                                          ; preds = %23
  %25 = getelementptr inbounds i8, ptr %16, i64 48
  %26 = load ptr, ptr %25, align 8, !tbaa !31
  %27 = getelementptr inbounds i8, ptr %0, i64 11184
  %28 = getelementptr inbounds i8, ptr %10, i64 48
  %29 = call i64 %26(ptr noundef %16, ptr noundef nonnull %27, i32 noundef 0, ptr noundef null, i32 noundef %24, ptr noundef nonnull %12, ptr noundef nonnull %28) #3
  br label %56

30:                                               ; preds = %23
  %31 = call zeroext i8 @DebugAssertEnabled() #3
  %32 = icmp eq i8 %31, 0
  %or.cond6 = or i1 %19, %32
  br i1 %or.cond6, label %34, label %33

33:                                               ; preds = %30
  call void @DebugAssert(ptr noundef nonnull @.str, i64 noundef 1171, ptr noundef nonnull @.str.12) #3
  br label %34

34:                                               ; preds = %33, %30
  %35 = call ptr @AllocatePool(i64 noundef 9) #3
  %36 = zext i32 %24 to i64
  %37 = getelementptr inbounds [16 x ptr], ptr %12, i64 0, i64 %36
  store ptr %35, ptr %37, align 8, !tbaa !33
  %38 = icmp eq ptr %35, null
  br i1 %38, label %183, label %39

39:                                               ; preds = %34
  %40 = getelementptr inbounds i8, ptr %35, i64 3
  store <4 x i8> <i8 43, i8 7, i8 71, i8 4>, ptr %35, align 1, !tbaa !34
  %41 = getelementptr inbounds i8, ptr %35, i64 4
  %42 = call zeroext i16 @SwapBytes16(i16 noundef zeroext %1) #3
  store i16 %42, ptr %41, align 1, !tbaa !35
  %43 = load i16, ptr %2, align 2, !tbaa !30
  %44 = call zeroext i16 @SwapBytes16(i16 noundef zeroext %43) #3
  %45 = getelementptr inbounds i8, ptr %35, i64 6
  store i16 %44, ptr %45, align 1, !tbaa !37
  %46 = load i8, ptr %40, align 1, !tbaa !38
  %47 = zext i8 %46 to i64
  %48 = getelementptr inbounds [1 x i8], ptr %41, i64 0, i64 %47
  store i8 -1, ptr %48, align 1, !tbaa !34
  %49 = add i32 %24, 1
  %50 = getelementptr inbounds i8, ptr %16, i64 48
  %51 = load ptr, ptr %50, align 8, !tbaa !31
  %52 = getelementptr inbounds i8, ptr %0, i64 11184
  %53 = getelementptr inbounds i8, ptr %10, i64 48
  %54 = call i64 %51(ptr noundef %16, ptr noundef nonnull %52, i32 noundef 0, ptr noundef null, i32 noundef %49, ptr noundef nonnull %12, ptr noundef nonnull %53) #3
  %55 = load ptr, ptr %37, align 8, !tbaa !33
  call void @FreePool(ptr noundef %55) #3
  br label %56

56:                                               ; preds = %.thread, %39
  %57 = phi i64 [ %29, %.thread ], [ %54, %39 ]
  %58 = phi ptr [ %28, %.thread ], [ %53, %39 ]
  %59 = icmp slt i64 %57, 0
  br i1 %59, label %183, label %60

60:                                               ; preds = %56
  %61 = load ptr, ptr %58, align 8, !tbaa !40
  %62 = getelementptr inbounds i8, ptr %14, i64 7
  %63 = load i8, ptr %62, align 1, !tbaa !42
  %.not107 = icmp eq i8 %63, 0
  br i1 %.not107, label %72, label %64

64:                                               ; preds = %60
  %65 = getelementptr inbounds i8, ptr %61, i64 36
  %66 = call i64 @NetLibGetSystemGuid(ptr noundef nonnull %65) #3
  %67 = icmp slt i64 %66, 0
  br i1 %67, label %68, label %70

68:                                               ; preds = %64
  %69 = call ptr @ZeroMem(ptr noundef nonnull %65, i64 noundef 16) #3
  br label %70

70:                                               ; preds = %68, %64
  %71 = getelementptr inbounds i8, ptr %61, i64 10
  store i8 16, ptr %71, align 1, !tbaa !43
  br label %72

72:                                               ; preds = %70, %60
  %73 = call i32 @NetRandomInitSeed() #3
  %.fr = freeze i32 %73
  %74 = mul i32 %.fr, 1103515245
  %75 = add i32 %74, 12345
  %.not109 = icmp eq i32 %75, -1
  %76 = add nsw i32 %74, 12346
  %77 = select i1 %.not109, i32 %76, i32 %75
  %78 = call i32 @SwapBytes32(i32 noundef %77) #3
  %79 = load ptr, ptr %58, align 8, !tbaa !40
  %80 = getelementptr inbounds i8, ptr %79, i64 12
  store i32 %78, ptr %80, align 1, !tbaa !44
  %81 = select i1 %.not111.not, i16 -32768, i16 0
  %82 = call zeroext i16 @SwapBytes16(i16 noundef zeroext %81) #3
  %83 = load ptr, ptr %58, align 8, !tbaa !40
  %84 = getelementptr inbounds i8, ptr %83, i64 18
  store i16 %82, ptr %84, align 1, !tbaa !45
  %85 = getelementptr inbounds i8, ptr %83, i64 20
  %86 = getelementptr inbounds i8, ptr %0, i64 10784
  %87 = call ptr @CopyMem(ptr noundef nonnull %85, ptr noundef nonnull %86, i64 noundef 4) #3
  %88 = getelementptr inbounds i8, ptr %10, i64 20
  store i16 %., ptr %88, align 4, !tbaa !46
  %89 = getelementptr inbounds i8, ptr %10, i64 16
  %90 = getelementptr inbounds i8, ptr %10, i64 22
  %91 = getelementptr inbounds i8, ptr %0, i64 10816
  br i1 %.not111.not, label %.thread118, label %94

.thread118:                                       ; preds = %72
  %92 = call ptr @SetMem(ptr noundef nonnull %89, i64 noundef 4, i8 noundef zeroext -1) #3
  %93 = call ptr @CopyMem(ptr noundef nonnull %90, ptr noundef nonnull %91, i64 noundef 4) #3
  br label %105

94:                                               ; preds = %72
  %95 = call ptr @CopyMem(ptr noundef nonnull %89, ptr noundef nonnull %4, i64 noundef 4) #3
  %96 = call ptr @CopyMem(ptr noundef nonnull %90, ptr noundef nonnull %91, i64 noundef 4) #3
  %97 = getelementptr inbounds i8, ptr %10, i64 28
  store i32 1, ptr %97, align 4, !tbaa !47
  %98 = getelementptr inbounds i8, ptr %10, i64 32
  store ptr %11, ptr %98, align 8, !tbaa !48
  %99 = getelementptr inbounds i8, ptr %11, i64 8
  store i16 4011, ptr %99, align 2, !tbaa !49
  %100 = call ptr @CopyMem(ptr noundef nonnull %11, ptr noundef nonnull %86, i64 noundef 4) #3
  %101 = load ptr, ptr %98, align 8, !tbaa !48
  %102 = getelementptr inbounds i8, ptr %101, i64 4
  %103 = getelementptr inbounds i8, ptr %0, i64 10800
  %104 = call ptr @CopyMem(ptr noundef nonnull %102, ptr noundef nonnull %103, i64 noundef 4) #3
  br label %105

105:                                              ; preds = %.thread118, %94
  %106 = getelementptr inbounds i8, ptr %10, i64 40
  %107 = getelementptr inbounds i8, ptr %16, i64 56
  store i32 1, ptr %106, align 8, !tbaa !51
  %108 = load ptr, ptr %58, align 8, !tbaa !40
  %109 = getelementptr inbounds i8, ptr %108, i64 16
  store i16 0, ptr %109, align 1, !tbaa !52
  %110 = load ptr, ptr %107, align 8, !tbaa !53
  %111 = call i64 %110(ptr noundef nonnull %16, ptr noundef nonnull %10) #3
  %112 = load i64, ptr %10, align 8, !tbaa !54
  %.not113 = icmp eq i64 %112, -9223372036854775790
  br i1 %.not113, label %113, label %131

113:                                              ; preds = %105
  store i32 2, ptr %106, align 8, !tbaa !51
  %114 = load ptr, ptr %58, align 8, !tbaa !40
  %115 = getelementptr inbounds i8, ptr %114, i64 16
  store i16 1, ptr %115, align 1, !tbaa !52
  %116 = load ptr, ptr %107, align 8, !tbaa !53
  %117 = call i64 %116(ptr noundef nonnull %16, ptr noundef nonnull %10) #3
  %118 = load i64, ptr %10, align 8, !tbaa !54
  %.not113.1 = icmp eq i64 %118, -9223372036854775790
  br i1 %.not113.1, label %119, label %131

119:                                              ; preds = %113
  store i32 3, ptr %106, align 8, !tbaa !51
  %120 = load ptr, ptr %58, align 8, !tbaa !40
  %121 = getelementptr inbounds i8, ptr %120, i64 16
  store i16 2, ptr %121, align 1, !tbaa !52
  %122 = load ptr, ptr %107, align 8, !tbaa !53
  %123 = call i64 %122(ptr noundef nonnull %16, ptr noundef nonnull %10) #3
  %124 = load i64, ptr %10, align 8, !tbaa !54
  %.not113.2 = icmp eq i64 %124, -9223372036854775790
  br i1 %.not113.2, label %125, label %131

125:                                              ; preds = %119
  store i32 4, ptr %106, align 8, !tbaa !51
  %126 = load ptr, ptr %58, align 8, !tbaa !40
  %127 = getelementptr inbounds i8, ptr %126, i64 16
  store i16 3, ptr %127, align 1, !tbaa !52
  %128 = load ptr, ptr %107, align 8, !tbaa !53
  %129 = call i64 %128(ptr noundef nonnull %16, ptr noundef nonnull %10) #3
  %130 = load i64, ptr %10, align 8, !tbaa !54
  %.not113.3 = icmp eq i64 %130, -9223372036854775790
  br i1 %.not113.3, label %.thread119, label %131

131:                                              ; preds = %125, %119, %113, %105
  %.lcssa = phi i64 [ %111, %105 ], [ %117, %113 ], [ %123, %119 ], [ %129, %125 ]
  %132 = icmp slt i64 %.lcssa, 0
  br i1 %132, label %.thread119, label %133

133:                                              ; preds = %131
  %134 = getelementptr inbounds i8, ptr %10, i64 64
  %135 = load ptr, ptr %134, align 8, !tbaa !55
  %136 = getelementptr inbounds i8, ptr %10, i64 56
  %137 = load i32, ptr %136, align 8, !tbaa !56
  %.not146 = icmp eq i32 %137, 0
  br i1 %.not146, label %._crit_edge132.thread160, label %.preheader.lr.ph

.preheader.lr.ph:                                 ; preds = %133
  %138 = getelementptr inbounds i8, ptr %0, i64 10832
  %.not147 = icmp eq i16 %5, 0
  br i1 %.not147, label %._crit_edge132.thread, label %.preheader.us.preheader

.preheader.us.preheader:                          ; preds = %.preheader.lr.ph
  %wide.trip.count = zext i16 %5 to i64
  br label %.preheader.us

.preheader.us:                                    ; preds = %.preheader.us.preheader, %153
  %139 = phi i32 [ %158, %153 ], [ 0, %.preheader.us.preheader ]
  %.094131.us = phi i16 [ %154, %153 ], [ 0, %.preheader.us.preheader ]
  %.096130.us = phi ptr [ %157, %153 ], [ %135, %.preheader.us.preheader ]
  %140 = getelementptr inbounds i8, ptr %.096130.us, i64 28
  br label %141

141:                                              ; preds = %.preheader.us, %151
  %indvars.iv = phi i64 [ 0, %.preheader.us ], [ %indvars.iv.next, %151 ]
  %142 = getelementptr inbounds %struct.EFI_PXE_BASE_CODE_SRVLIST, ptr %6, i64 %indvars.iv
  %143 = getelementptr inbounds i8, ptr %142, i64 2
  %144 = load i8, ptr %143, align 2, !tbaa !57
  %.not114.us = icmp eq i8 %144, 0
  br i1 %.not114.us, label %145, label %._crit_edge.us

145:                                              ; preds = %141
  %146 = load i16, ptr %142, align 4, !tbaa !59
  %147 = icmp eq i16 %146, %1
  br i1 %147, label %148, label %151

148:                                              ; preds = %145
  %149 = call i64 @CompareMem(ptr noundef nonnull %140, ptr noundef nonnull %138, i64 noundef 4) #3
  %150 = icmp eq i64 %149, 0
  br i1 %150, label %._crit_edge.us, label %151

151:                                              ; preds = %148, %145
  %indvars.iv.next = add nuw nsw i64 %indvars.iv, 1
  %exitcond.not = icmp eq i64 %indvars.iv.next, %wide.trip.count
  br i1 %exitcond.not, label %._crit_edge.us.thread, label %141, !llvm.loop !60

._crit_edge.us.thread:                            ; preds = %151
  %.pre.pre154 = load i32, ptr %136, align 8, !tbaa !56
  br label %153

._crit_edge.us:                                   ; preds = %141, %148
  %152 = trunc nuw i64 %indvars.iv to i16
  %.not148 = icmp eq i16 %152, %5
  %.pre.pre = load i32, ptr %136, align 8, !tbaa !56
  br i1 %.not148, label %153, label %._crit_edge132

153:                                              ; preds = %._crit_edge.us.thread, %._crit_edge.us
  %.pre.pre155 = phi i32 [ %.pre.pre154, %._crit_edge.us.thread ], [ %.pre.pre, %._crit_edge.us ]
  %154 = add i16 %.094131.us, 1
  %155 = load i32, ptr %.096130.us, align 1, !tbaa !62
  %156 = zext i32 %155 to i64
  %157 = getelementptr inbounds i8, ptr %.096130.us, i64 %156
  %158 = zext i16 %154 to i32
  %159 = icmp ugt i32 %.pre.pre155, %158
  br i1 %159, label %.preheader.us, label %._crit_edge132, !llvm.loop !63

._crit_edge132:                                   ; preds = %153, %._crit_edge.us
  %160 = phi i32 [ %.pre.pre155, %153 ], [ %.pre.pre, %._crit_edge.us ]
  %.096.lcssa = phi ptr [ %157, %153 ], [ %.096130.us, %._crit_edge.us ]
  %.lcssa122 = phi i32 [ %158, %153 ], [ %139, %._crit_edge.us ]
  %161 = icmp ugt i32 %160, %.lcssa122
  br i1 %161, label %._crit_edge132.thread, label %thread-pre-split

._crit_edge132.thread:                            ; preds = %.preheader.lr.ph, %._crit_edge132
  %.096.lcssa159 = phi ptr [ %.096.lcssa, %._crit_edge132 ], [ %135, %.preheader.lr.ph ]
  %.not115 = icmp eq ptr %8, null
  br i1 %.not115, label %163, label %162

162:                                              ; preds = %._crit_edge132.thread
  call void @PxeBcCopyEfiDhcp4Packet(ptr noundef nonnull %8, ptr noundef %.096.lcssa159)
  br label %163

163:                                              ; preds = %162, %._crit_edge132.thread
  br i1 %.not, label %thread-pre-split, label %164

164:                                              ; preds = %163
  %165 = getelementptr inbounds i8, ptr %14, i64 4468
  %166 = load ptr, ptr %58, align 8, !tbaa !40
  %167 = getelementptr inbounds i8, ptr %166, i64 8
  %168 = getelementptr inbounds i8, ptr %166, i64 4
  %169 = load i32, ptr %168, align 1, !tbaa !64
  %170 = zext i32 %169 to i64
  %171 = call ptr @CopyMem(ptr noundef nonnull %165, ptr noundef nonnull %167, i64 noundef %170) #3
  %172 = getelementptr inbounds i8, ptr %14, i64 11
  store i8 1, ptr %172, align 1, !tbaa !65
  %173 = getelementptr inbounds i8, ptr %14, i64 5940
  %174 = getelementptr inbounds i8, ptr %.096.lcssa159, i64 8
  %175 = getelementptr inbounds i8, ptr %.096.lcssa159, i64 4
  %176 = load i32, ptr %175, align 1, !tbaa !64
  %177 = zext i32 %176 to i64
  %178 = call ptr @CopyMem(ptr noundef nonnull %173, ptr noundef nonnull %174, i64 noundef %177) #3
  %179 = getelementptr inbounds i8, ptr %14, i64 12
  store i8 1, ptr %179, align 4, !tbaa !66
  br label %thread-pre-split

thread-pre-split:                                 ; preds = %164, %163, %._crit_edge132
  %.3.ph = phi i64 [ -9223372036854775794, %._crit_edge132 ], [ %.lcssa, %163 ], [ %.lcssa, %164 ]
  %.pr = load ptr, ptr %134, align 8, !tbaa !55
  br label %._crit_edge132.thread160

._crit_edge132.thread160:                         ; preds = %133, %thread-pre-split
  %180 = phi ptr [ %.pr, %thread-pre-split ], [ %135, %133 ]
  %.3 = phi i64 [ %.3.ph, %thread-pre-split ], [ -9223372036854775794, %133 ]
  %.not116 = icmp eq ptr %180, null
  br i1 %.not116, label %.thread119, label %181

181:                                              ; preds = %._crit_edge132.thread160
  call void @FreePool(ptr noundef nonnull %180) #3
  br label %.thread119

.thread119:                                       ; preds = %125, %._crit_edge132.thread160, %181, %131
  %.4 = phi i64 [ %.lcssa, %131 ], [ %.3, %181 ], [ %.3, %._crit_edge132.thread160 ], [ -9223372036854775790, %125 ]
  %182 = load ptr, ptr %58, align 8, !tbaa !40
  call void @FreePool(ptr noundef %182) #3
  br label %183

183:                                              ; preds = %56, %34, %.thread119
  %.0 = phi i64 [ %.4, %.thread119 ], [ -9223372036854775799, %34 ], [ %57, %56 ]
  call void @llvm.lifetime.end.p0(i64 128, ptr nonnull %12) #3
  call void @llvm.lifetime.end.p0(i64 10, ptr nonnull %11) #3
  call void @llvm.lifetime.end.p0(i64 72, ptr nonnull %10) #3
  ret i64 %.0
}

declare zeroext i16 @SwapBytes16(i16 noundef zeroext) local_unnamed_addr #1

declare i64 @NetLibGetSystemGuid(ptr noundef) local_unnamed_addr #1

; Function Attrs: nounwind uwtable
declare dso_local i32 @PxeBcBuildDhcpOptions(ptr noundef, ptr noundef, i8 noundef zeroext) local_unnamed_addr #2

declare ptr @AllocatePool(i64 noundef) local_unnamed_addr #1

declare void @FreePool(ptr noundef) local_unnamed_addr #1

declare i32 @NetRandomInitSeed() local_unnamed_addr #1

declare i32 @SwapBytes32(i32 noundef) local_unnamed_addr #1

declare ptr @SetMem(ptr noundef, i64 noundef, i8 noundef zeroext) local_unnamed_addr #1

attributes #0 = { mustprogress nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #1 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #2 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nounwind }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !10, i64 184}
!6 = !{!"_PXEBC_PRIVATE_DATA", !7, i64 0, !10, i64 8, !10, i64 16, !10, i64 24, !10, i64 32, !10, i64 40, !10, i64 48, !10, i64 56, !10, i64 64, !10, i64 72, !11, i64 80, !13, i64 192, !14, i64 200, !10, i64 216, !10, i64 224, !10, i64 232, !10, i64 240, !15, i64 248, !10, i64 280, !10, i64 288, !10, i64 296, !17, i64 304, !18, i64 308, !19, i64 344, !7, i64 10768, !10, i64 10776, !8, i64 10784, !8, i64 10800, !8, i64 10816, !8, i64 10832, !8, i64 10848, !7, i64 10852, !12, i64 10856, !12, i64 10864, !8, i64 10872, !23, i64 11184, !16, i64 11433, !8, i64 11465, !8, i64 11466, !8, i64 11467, !7, i64 11468, !7, i64 11472, !7, i64 11476, !26, i64 11480, !26, i64 13152, !26, i64 14824, !8, i64 16496, !8, i64 43248, !8, i64 43268, !7, i64 43588, !8, i64 43592, !8, i64 43612, !10, i64 43680, !28, i64 43688}
!7 = !{!"int", !8, i64 0}
!8 = !{!"omnipotent char", !9, i64 0}
!9 = !{!"Simple C/C++ TBAA"}
!10 = !{!"any pointer", !8, i64 0}
!11 = !{!"_EFI_PXE_BASE_CODE_PROTOCOL", !12, i64 0, !10, i64 8, !10, i64 16, !10, i64 24, !10, i64 32, !10, i64 40, !10, i64 48, !10, i64 56, !10, i64 64, !10, i64 72, !10, i64 80, !10, i64 88, !10, i64 96, !10, i64 104}
!12 = !{!"long long", !8, i64 0}
!13 = !{!"_EFI_LOAD_FILE_PROTOCOL", !10, i64 0}
!14 = !{!"_EFI_PXE_BASE_CODE_CALLBACK_PROTOCOL", !12, i64 0, !10, i64 8}
!15 = !{!"", !8, i64 0, !8, i64 1, !8, i64 2, !8, i64 3, !8, i64 4, !8, i64 5, !16, i64 6, !16, i64 10, !8, i64 14, !8, i64 15, !8, i64 16, !8, i64 17, !7, i64 20, !7, i64 24}
!16 = !{!"", !8, i64 0}
!17 = !{!"short", !8, i64 0}
!18 = !{!"", !8, i64 0, !8, i64 1, !8, i64 2, !8, i64 3, !8, i64 4, !8, i64 5, !8, i64 6, !7, i64 8, !7, i64 12, !8, i64 16, !16, i64 17, !16, i64 21, !17, i64 26, !16, i64 28, !17, i64 32}
!19 = !{!"", !8, i64 0, !8, i64 1, !8, i64 2, !8, i64 3, !8, i64 4, !8, i64 5, !8, i64 6, !8, i64 7, !8, i64 8, !8, i64 9, !8, i64 10, !8, i64 11, !8, i64 12, !8, i64 13, !8, i64 14, !8, i64 15, !8, i64 16, !8, i64 17, !8, i64 18, !8, i64 20, !8, i64 36, !8, i64 52, !8, i64 1524, !8, i64 2996, !8, i64 4468, !8, i64 5940, !8, i64 7412, !20, i64 8884, !7, i64 9016, !8, i64 9020, !7, i64 9404, !8, i64 9408, !21, i64 9792, !22, i64 10296}
!20 = !{!"", !8, i64 0, !8, i64 1, !17, i64 2, !8, i64 4}
!21 = !{!"", !8, i64 0, !8, i64 1, !17, i64 2, !8, i64 4, !8, i64 8}
!22 = !{!"", !8, i64 0, !8, i64 1}
!23 = !{!"", !7, i64 0, !7, i64 4, !24, i64 8}
!24 = !{!"", !25, i64 0, !7, i64 236, !8, i64 240}
!25 = !{!"", !8, i64 0, !8, i64 1, !8, i64 2, !8, i64 3, !7, i64 4, !17, i64 8, !17, i64 10, !16, i64 12, !16, i64 16, !16, i64 20, !16, i64 24, !8, i64 28, !8, i64 44, !8, i64 108}
!26 = !{!"", !8, i64 0, !8, i64 1480, !8, i64 1481, !8, i64 1488, !27, i64 1544}
!27 = !{!"", !8, i64 0, !16, i64 32, !17, i64 36, !17, i64 38, !8, i64 40, !8, i64 41, !8, i64 42, !16, i64 43, !16, i64 47, !17, i64 52, !17, i64 54, !17, i64 56, !17, i64 58, !10, i64 64, !8, i64 72, !10, i64 80, !8, i64 88, !10, i64 96, !8, i64 104, !10, i64 112, !8, i64 120}
!28 = !{!"", !10, i64 0, !12, i64 8, !8, i64 16}
!29 = !{!6, !10, i64 232}
!30 = !{!17, !17, i64 0}
!31 = !{!32, !10, i64 48}
!32 = !{!"_EFI_DHCP4_PROTOCOL", !10, i64 0, !10, i64 8, !10, i64 16, !10, i64 24, !10, i64 32, !10, i64 40, !10, i64 48, !10, i64 56, !10, i64 64}
!33 = !{!10, !10, i64 0}
!34 = !{!8, !8, i64 0}
!35 = !{!36, !17, i64 0}
!36 = !{!"", !17, i64 0, !17, i64 2}
!37 = !{!36, !17, i64 2}
!38 = !{!39, !8, i64 1}
!39 = !{!"", !8, i64 0, !8, i64 1, !8, i64 2}
!40 = !{!41, !10, i64 48}
!41 = !{!"", !12, i64 0, !10, i64 8, !16, i64 16, !17, i64 20, !16, i64 22, !7, i64 28, !10, i64 32, !7, i64 40, !10, i64 48, !7, i64 56, !10, i64 64}
!42 = !{!19, !8, i64 7}
!43 = !{!25, !8, i64 2}
!44 = !{!23, !7, i64 12}
!45 = !{!23, !17, i64 18}
!46 = !{!41, !17, i64 20}
!47 = !{!41, !7, i64 28}
!48 = !{!41, !10, i64 32}
!49 = !{!50, !17, i64 8}
!50 = !{!"", !16, i64 0, !16, i64 4, !17, i64 8}
!51 = !{!41, !7, i64 40}
!52 = !{!23, !17, i64 16}
!53 = !{!32, !10, i64 56}
!54 = !{!41, !12, i64 0}
!55 = !{!41, !10, i64 64}
!56 = !{!41, !7, i64 56}
!57 = !{!58, !8, i64 2}
!58 = !{!"", !17, i64 0, !8, i64 2, !8, i64 3, !8, i64 4}
!59 = !{!58, !17, i64 0}
!60 = distinct !{!60, !61}
!61 = !{!"llvm.loop.mustprogress"}
!62 = !{!23, !7, i64 0}
!63 = distinct !{!63, !61}
!64 = !{!23, !7, i64 4}
!65 = !{!19, !8, i64 11}
!66 = !{!19, !8, i64 12}


; Effective O3 passes: CorrelatedValuePropagationPass,EarlyCSEPass,GVNPass,GlobalOptPass,IPSCCPPass,IndVarSimplifyPass,InferFunctionAttrsPass,InstCombinePass,InstSimplifyPass,JumpThreadingPass,LCSSAPass,LICMPass,LoopInstSimplifyPass,LoopRotatePass,LoopSimplifyCFGPass,LoopSimplifyPass,LoopUnrollPass,PostOrderFunctionAttrsPass,ReassociatePass,SLPVectorizerPass,SROAPass,SimplifyCFGPass