theory Untyped_AI

lemma untyped_inc':
  assumes inc: "untyped_inc m cs"
  assumes d: "descendants_range (default_cap tp oref sz dev) src s"
  assumes r: "untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap"
  assumes al: "cap_aligned (default_cap tp oref sz dev)"
  assumes noint: "untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}"
  shows "untyped_inc (m(dest \<mapsto> src)) (cs(dest \<mapsto> default_cap tp oref sz dev))" using inc r c_src al ut noint unfolding untyped_inc_def descendants_of_def apply (intro allI impI) apply (rule conjI) apply (simp add: parency del: split_paired_All split: if_split_asm) apply (rule untyped_ranges_aligned_disjoing_or_subset[OF _ cs_cap_aligned]) apply simp apply simp apply (rule untyped_ranges_aligned_disjoing_or_subset[OF cs_cap_aligned _ ]) apply simp apply simp apply (case_tac "p' = src") apply (simp add: parency del: split_paired_All split: if_split_asm) apply (erule_tac x=src in allE) apply (erule_tac x=p in allE) apply (simp add: c_dest) apply (simp add: subseteq_imp_not_subset) apply (intro impI) apply (drule(1) usable_range_subseteq[OF cs_cap_aligned]) apply simp apply (drule Int_absorb1) apply simp apply (simp add: c_dest) apply (erule_tac x = src in allE) apply (erule_tac x = p in allE) apply simp apply (elim conjE) apply (rule conjI) apply (intro impI) apply (elim disjE) apply (clarsimp+)[3] apply (erule subset_splitE) apply clarsimp apply (intro conjI impI) apply simp+ apply (intro conjI impI,clarsimp+)[1] apply (intro conjI impI,clarsimp+)[1] apply (simp add: parency del: split_paired_All split: if_split_asm) apply (erule_tac x=src in allE) apply (erule_tac x=p' in allE) apply simp apply (elim conjE) apply (erule subset_splitE) apply (intro conjI) apply (intro impI) apply blast apply blast apply (intro conjI) apply (intro impI) apply (drule trancl_trans) apply fastforce apply simp apply (intro impI) apply (cut_tac p' = p' in d_rangeD[OF d]) apply simp+ apply (drule(1) untyped_range_non_empty[OF _ cs_cap_aligned]) apply (drule(1) untyped_range_non_empty) apply (rule int_not_empty_subsetD) apply (simp add:Int_ac) apply simp apply simp apply simp apply (intro conjI) apply (intro impI) apply (erule disjE) apply (drule trancl_trans) apply fastforce apply simp apply (simp add: subseteq_imp_not_subset) apply (drule(1) untyped_range_non_empty[OF _ cs_cap_aligned]) apply (drule(1) untyped_range_non_empty) apply (elim disjE) apply (cut_tac p' = p' in d_rangeD[OF d]) apply clarsimp apply simp apply fastforce apply clarsimp apply (drule(1) untyped_range_non_empty[OF _ cs_cap_aligned]) apply (drule(1) untyped_range_non_empty) apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply blast apply (erule_tac x = src in allE) apply (erule_tac x = p in allE) apply simp apply (elim conjE) apply (erule subset_splitE) apply simp apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply blast apply (intro conjI) apply (intro impI) apply (drule trancl_trans) apply fastforce apply simp apply clarsimp apply simp apply (elim conjE) apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply (thin_tac "P \<inter> Q = {}" for P Q)+ apply (intro impI) apply (drule d_rangeD[OF d]) apply simp apply (drule(1) untyped_range_non_empty[OF _ cs_cap_aligned])+ apply (drule(1) untyped_range_non_empty)+ apply (intro conjI) apply (rule notI) apply (drule(1) disjoint_subset2[OF psubset_imp_subset,rotated]) apply simp apply (rule notI) apply (drule(1) disjoint_subset[OF psubset_imp_subset,rotated]) apply simp apply blast apply simp apply (intro conjI) apply (intro impI) apply (erule disjE) apply (drule trancl_trans) apply fastforce apply simp apply fastforce apply (clarsimp simp: subseteq_imp_not_subset) apply (drule(1) usable_range_subseteq[OF cs_cap_aligned] ) apply blast apply (rule impI) apply simp apply (drule(1) untyped_range_non_empty[OF _ cs_cap_aligned])+ apply (drule(1) untyped_range_non_empty)+ apply (elim conjE | simp)+ apply (drule d_rangeD[OF d]) apply simp apply (intro conjI) apply (rule notI) apply (drule(1) disjoint_subset2[OF psubset_imp_subset,rotated]) apply simp apply (rule notI) apply (drule(1) disjoint_subset[OF psubset_imp_subset,rotated]) apply simp apply blast apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply (drule disjoint_subset2) apply (simp (no_asm) add:Int_ac) apply (drule(1) untyped_range_non_empty[OF _ cs_cap_aligned])+ apply (drule(1) untyped_range_non_empty)+ apply blast apply (erule_tac x= src in allE) apply (erule_tac x = p' in allE) apply simp apply (intro impI conjI) apply simp+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. untyped_inc (m(dest \<mapsto> src)) (cs(dest \<mapsto> default_cap tp oref sz dev)) proof (prove)
using this:
untyped_inc m cs
untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap
cs src = Some cap
cap_aligned (default_cap tp oref sz dev)
is_untyped_cap cap
untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}

goal (1 subgoal):
 1. untyped_inc (m(dest \<mapsto> src)) (cs(dest \<mapsto> default_cap tp oref sz dev)) proof (prove)
using this:
\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p')
untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap
cs src = Some cap
cap_aligned (default_cap tp oref sz dev)
is_untyped_cap cap
untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}

goal (1 subgoal):
 1. \<forall>p p' c c'. (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> cap_aligned c
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> cs (?p51 p p' c c') = Some c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> cs (?p51 p p' c c') = Some c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> cs (?p65 p p' c c') = Some c
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> cap_aligned c'
 3. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> cap_aligned c'
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' = src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p')
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c'; src = dest; c = c'\<rbrakk> \<Longrightarrow> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range cap = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 5. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c'; src = dest; c = c'; \<forall>p' c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range cap = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 5. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c'; src = dest; c = c'; \<forall>c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p))\<rbrakk> \<Longrightarrow> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range cap = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 5. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range cap = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 4. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>a b aa ba c. cs (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> usable_untyped_range c = {} \<or> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); untyped_range c \<subseteq> untyped_range cap; c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 4. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>a b aa ba c. cs (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> usable_untyped_range c = {} \<or> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); untyped_range c \<subseteq> untyped_range cap; c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range c = untyped_range cap\<rbrakk> \<Longrightarrow> usable_untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 4. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>a b aa ba c. cs (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> usable_untyped_range c = {} \<or> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); untyped_range c \<subseteq> untyped_range cap; c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; untyped_range c = untyped_range cap; usable_untyped_range cap \<subseteq> untyped_range cap\<rbrakk> \<Longrightarrow> usable_untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 4. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>a b aa ba c. cs (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> usable_untyped_range c = {} \<or> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range cap \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; untyped_range c = untyped_range cap; usable_untyped_range cap \<subseteq> untyped_range cap\<rbrakk> \<Longrightarrow> usable_untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 4. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>a b aa ba c. cs (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> (a, b) \<rightarrow> (aa, ba) \<and> usable_untyped_range c = {} \<or> m \<Turnstile> (aa, ba) \<rightarrow> (a, b) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); c' = cap; cap_aligned c; is_untyped_cap cap; untyped_range cap \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; src \<noteq> dest; untyped_range c = untyped_range cap; untyped_range cap \<inter> usable_untyped_range cap = usable_untyped_range cap\<rbrakk> \<Longrightarrow> usable_untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 4. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' = dest; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs dest = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 3. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; \<forall>p' c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; \<forall>c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p))\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; (untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}) \<and> (untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}) \<and> (untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p)\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> m \<Turnstile> p \<rightarrow> src \<longrightarrow> untyped_range c = untyped_range cap \<longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src
 2. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 3. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; m \<Turnstile> p \<rightarrow> src; untyped_range c = untyped_range cap\<rbrakk> \<Longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src
 2. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 3. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; m \<Turnstile> p \<rightarrow> src; untyped_range c = untyped_range cap; untyped_range cap \<subseteq> untyped_range c\<rbrakk> \<Longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src
 2. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; m \<Turnstile> p \<rightarrow> src; untyped_range c = untyped_range cap; untyped_range c \<subseteq> untyped_range cap\<rbrakk> \<Longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src
 3. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; m \<Turnstile> p \<rightarrow> src; untyped_range c = untyped_range cap; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> usable_untyped_range c = {} \<or> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> p = src
 4. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 5. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<subset> untyped_range c\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 3. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 4. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 5. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 3. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 4. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (8 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; p = src\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range cap
 2. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; p = src\<rbrakk> \<Longrightarrow> \<not> untyped_range cap \<subset> untyped_range c
 3. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src\<rbrakk> \<Longrightarrow> \<not> untyped_range cap \<subset> untyped_range c
 4. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c = untyped_range cap\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> p
 5. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c = untyped_range cap\<rbrakk> \<Longrightarrow> usable_untyped_range cap = {}
 6. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 7. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 8. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range c; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 3. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' = src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; c' = cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; src \<noteq> dest; cs src = Some cap; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range cap \<and> \<not> untyped_range cap \<subset> untyped_range c) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range cap \<subset> untyped_range c \<and> (untyped_range c = untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}))
 2. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p'); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; (cs(dest \<mapsto> default_cap tp oref sz dev)) p = Some c; is_untyped_cap c; (cs(dest \<mapsto> default_cap tp oref sz dev)) p' = Some c'; is_untyped_cap c'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> {q. m(dest \<mapsto> src) \<Turnstile> p \<rightarrow> q} \<and> usable_untyped_range c = {} \<or> p \<in> {q. m(dest \<mapsto> src) \<Turnstile> p' \<rightarrow> q} \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; \<forall>p' c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; \<forall>c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; (untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}) \<and> (untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {})\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 7. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<subset> untyped_range c'; m \<Turnstile> p' \<rightarrow> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 7. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; m \<Turnstile> p' \<rightarrow> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> ?z2227 p p' c c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; m \<Turnstile> p' \<rightarrow> ?z2227 p p' c c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 7. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; m \<Turnstile> p' \<rightarrow> p'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> p'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; \<exists>c. cs p' = Some c \<and> untyped_range c \<inter> untyped_range (default_cap tp oref sz dev) = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> {}
 3. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c' \<noteq> {}
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 7. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> {}
 2. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c' \<noteq> {}
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<leadsto> p' \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<inter> untyped_range c = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c' \<noteq> {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'; m \<Turnstile> p' \<rightarrow> src\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; m \<Turnstile> p' \<rightarrow> src; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; m \<Turnstile> p' \<rightarrow> src; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> ?z2317 p p' c c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}; m \<Turnstile> p' \<rightarrow> ?z2317 p p' c c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; m \<Turnstile> p' \<rightarrow> src; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 7. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}; m \<Turnstile> p' \<rightarrow> p'\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; m \<Turnstile> p' \<rightarrow> src; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; m \<Turnstile> p' \<rightarrow> src; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> p'
 2. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}; \<exists>c. cs p' = Some c \<and> untyped_range c \<inter> untyped_range (default_cap tp oref sz dev) = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}; \<exists>c. cs p' = Some c \<and> untyped_range c \<inter> untyped_range (default_cap tp oref sz dev) = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {}; untyped_range c' \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range c'; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap = untyped_range c'; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}; m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> (p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}; untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}; untyped_range cap \<inter> untyped_range c' = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>p' \<noteq> src; untyped_range c \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c; is_untyped_cap cap; untyped_range c \<inter> usable_untyped_range cap = {}; p = dest; default_cap tp oref sz dev = c; p' \<noteq> dest; cs p' = Some c'; untyped_range cap \<inter> untyped_range c' = {}; untyped_range c' \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; \<forall>p' c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; \<forall>c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p))\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; (untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}) \<and> (untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}) \<and> (untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p)\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subseteq> untyped_range c \<or> untyped_range c \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c = {}; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<subset> untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<leadsto> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<leadsto> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<subset> untyped_range c\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {}) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {}))
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range cap \<subset> untyped_range c\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {}) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {}))
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; m \<Turnstile> p \<rightarrow> src\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> ?z3870 p p' c c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; m \<Turnstile> p \<rightarrow> ?z3870 p p' c c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 7. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; m \<Turnstile> p \<rightarrow> p\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<leadsto> p \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<leadsto> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<leadsto> p \<and> usable_untyped_range cap = {} \<or> usable_untyped_range c = {} \<or> src = p; untyped_range c \<subset> untyped_range cap; m \<Turnstile> src \<rightarrow> p; untyped_range c \<inter> usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; m \<Turnstile> src \<rightarrow> p; untyped_range c \<inter> usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; m \<Turnstile> src \<rightarrow> p\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; m \<Turnstile> src \<rightarrow> p; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; \<exists>c. cs p = Some c \<and> untyped_range c \<inter> untyped_range (default_cap tp oref sz dev) = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c' \<subset> untyped_range c
 3. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; untyped_range c \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c' \<subset> untyped_range c
 3. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; untyped_range c \<subset> untyped_range c'; untyped_range c \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c' \<subset> untyped_range c
 3. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c' \<subset> untyped_range c
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; untyped_range c' \<subset> untyped_range c; untyped_range c' \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range c \<subset> untyped_range cap; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c; m \<Turnstile> p \<rightarrow> src\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; m \<Turnstile> p \<rightarrow> src; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; m \<Turnstile> p \<rightarrow> src; m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> ?z4122 p p' c c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}; m \<Turnstile> p \<rightarrow> ?z4122 p p' c c'\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; m \<Turnstile> p \<rightarrow> src; m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 7. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {}; m \<Turnstile> p \<rightarrow> p\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; m \<Turnstile> p \<rightarrow> src; m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; m \<Turnstile> p \<rightarrow> src; m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba. \<lbrakk>is_untyped_cap (default_cap tp oref sz dev); cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; cs (a, b) = Some cap; dest = (aa, ba); a = aa \<longrightarrow> b \<noteq> ba; src = (a, b); untyped_range cap = untyped_range (default_cap tp oref sz dev)\<rbrakk> \<Longrightarrow> usable_untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba. \<lbrakk>is_untyped_cap (default_cap tp oref sz dev); cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; dest = (aa, ba); a = aa \<longrightarrow> b \<noteq> ba; src = (a, b); untyped_range cap = untyped_range (default_cap tp oref sz dev); usable_untyped_range cap \<subseteq> untyped_range cap\<rbrakk> \<Longrightarrow> usable_untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c\<rbrakk> \<Longrightarrow> (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap = untyped_range c; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> src = p; untyped_range cap = untyped_range c; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> src = p; untyped_range cap = untyped_range c; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> src = p; untyped_range cap = untyped_range c; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; m \<Turnstile> src \<rightarrow> p; usable_untyped_range cap = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; \<exists>c. cs p = Some c \<and> untyped_range c \<inter> untyped_range (default_cap tp oref sz dev) = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c' \<subset> untyped_range c
 3. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}; untyped_range c \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c' \<subset> untyped_range c
 3. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<subset> untyped_range c'; untyped_range c \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c' \<subset> untyped_range c
 3. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> \<not> untyped_range c' \<subset> untyped_range c
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c' \<subset> untyped_range c; untyped_range c' \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>untyped_range c' \<subseteq> untyped_range c; cs src = Some cap; cap_aligned c'; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap = untyped_range c; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}; (p, src) \<notin> (cdt_parent_rel m)\<^sup>+; p \<noteq> src; usable_untyped_range cap = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c \<noteq> untyped_range c'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c = {}; untyped_range c \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range cap = {}; untyped_range cap = untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p \<rightarrow> src \<and> usable_untyped_range c = {} \<or> src = p; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; untyped_range c' \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<inter> untyped_range c = {}\<rbrakk> \<Longrightarrow> ?A4438 p p' c c' \<inter> untyped_range cap = {}
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<inter> untyped_range c = {}; ?A4438 p p' c c' \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; cs src = Some cap; cap_aligned c'; is_untyped_cap cap; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<inter> untyped_range c = {}; untyped_range c \<inter> untyped_range c' = {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; cs src = Some cap; cap_aligned c'; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<inter> untyped_range c = {}; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>cs src = Some cap; cap_aligned c'; untyped_range c' \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; p' = dest; default_cap tp oref sz dev = c'; untyped_range cap \<inter> untyped_range c = {}; untyped_range c \<inter> untyped_range c' = {}; untyped_range cap \<noteq> {}; untyped_range c \<noteq> {}; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<Turnstile> p \<rightarrow> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> (p = src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {})) \<and> ((p, src) \<notin> (cdt_parent_rel m)\<^sup>+ \<and> p \<noteq> src \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> \<not> untyped_range c' \<subset> untyped_range c \<and> untyped_range c \<noteq> untyped_range c')
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; \<forall>p p' c. cs p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> p \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> p \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> p \<and> usable_untyped_range c' = {} \<or> p = p')); untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; \<forall>p' c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; \<forall>c. cs src = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. cs p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {} \<or> src = p'))\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; (untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}) \<and> (untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {})\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> (m \<Turnstile> p' \<rightarrow> src \<longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {})) \<and> ((p', src) \<notin> (cdt_parent_rel m)\<^sup>+ \<longrightarrow> \<not> untyped_range c \<subset> untyped_range c' \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> m \<Turnstile> src \<rightarrow> p') \<and> (untyped_range c = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {})) proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; (untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}) \<and> (untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}); p = src; m \<Turnstile> p' \<rightarrow> src; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> p'
 2. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; (untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}) \<and> (untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}); p = src; m \<Turnstile> p' \<rightarrow> src; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range c = {} \<or> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; (untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}) \<and> (untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}); p = src; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> \<not> untyped_range c \<subset> untyped_range c'
 4. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; (untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}) \<and> (untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}); p = src; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> p'
 5. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; (untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}) \<and> (untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}); p = src; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> m \<Turnstile> src \<rightarrow> p'
 6. \<And>p p' c c'. \<lbrakk>is_untyped_cap c'; p' \<noteq> src; untyped_range (default_cap tp oref sz dev) \<subseteq> untyped_range cap; cs src = Some cap; cap_aligned (default_cap tp oref sz dev); is_untyped_cap cap; untyped_range (default_cap tp oref sz dev) \<inter> usable_untyped_range cap = {}; p \<noteq> dest; cs p = Some c; is_untyped_cap c; p' \<noteq> dest; cs p' = Some c'; (untyped_range cap \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range cap \<or> untyped_range cap \<inter> untyped_range c' = {}) \<and> (untyped_range cap \<subset> untyped_range c' \<longrightarrow> m \<Turnstile> p' \<rightarrow> src \<and> untyped_range cap \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range cap \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> untyped_range c' \<inter> usable_untyped_range cap = {}) \<and> (untyped_range cap = untyped_range c' \<longrightarrow> m \<Turnstile> src \<rightarrow> p' \<and> usable_untyped_range cap = {} \<or> m \<Turnstile> p' \<rightarrow> src \<and> usable_untyped_range c' = {}); p = src; (p', src) \<notin> (cdt_parent_rel m)\<^sup>+; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> usable_untyped_range c = {} proof (prove)
goal:
No subgoals!