theory CSpace_R

lemma cteInsert_mdb' [wp]:
  "\<lbrace>valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and
   (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s) \<rbrace>
  cteInsert cap src dest
  \<lbrace>\<lambda>_. valid_mdb'\<rbrace>" apply (simp add:valid_mdb'_def valid_mdb_ctes_def) apply (rule_tac Q = "\<lambda>r s. valid_dlist (ctes_of s) \<and> irq_control (ctes_of s) \<and>
               no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and>
               mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and>
               Q s" for Q
     in hoare_strengthen_post) prefer 2 apply clarsimp apply assumption apply (rule hoare_name_pre_state) apply (wp cteInsert_no_0 cteInsert_valid_dlist cteInsert_mdb_chain_0 cteInsert_untyped_inc'
            cteInsert_mdb_chunked cteInsert_untyped_mdb cteInsert_irq_control) apply (unfold cteInsert_def) apply (unfold cteInsert_def updateCap_def) apply (simp add: valid_mdb'_def split del: if_split) apply (wp updateMDB_ctes_of_no_0 getCTE_wp') apply (clarsimp simp: cte_wp_at_ctes_of simp del: fun_upd_apply) apply (wp hoare_vcg_imp_lift hoare_vcg_all_lift setUntypedCapAsFull_ctes_of
        setUntypedCapAsFull_ctes_of_no_0
        setUntypedCapAsFull_valid_dlist setUntypedCapAsFull_distinct_zombies
        setUntypedCapAsFull_valid_badges setUntypedCapAsFull_caps_contained
        setUntypedCapAsFull_valid_nullcaps setUntypedCapAsFull_ut_revocable
        setUntypedCapAsFull_class_links setUntypedCapAsFull_reply_masters_rvk_fb
        mdb_inv_preserve_fun_upd
        mdb_inv_preserve_modify_map getCTE_wp| simp del:fun_upd_apply)+ apply (clarsimp simp:cte_wp_at_ctes_of simp del:fun_upd_apply) defer apply (clarsimp simp:valid_mdb_ctes_def valid_mdb'_def simp del:fun_upd_apply)+ apply (case_tac cte) apply (rename_tac cap1 node1) apply (case_tac x) apply (rename_tac cap2 node2) apply (case_tac node1) apply (case_tac node2) apply (clarsimp simp:valid_mdb_ctes_def no_0_def nullPointer_def) apply (intro conjI impI) apply clarsimp apply (rename_tac s src_cap word1 word2 bool1a bool2a bool1 bool2) proof - fix s :: kernel_state fix bool1 bool2 src_cap word1 word2 bool1a bool2a let ?c1 = "(CTE src_cap (MDB word1 word2 bool1a bool2a))" let ?c2 = "(CTE capability.NullCap (MDB 0 0 bool1 bool2))" let ?C = "(modify_map
             (modify_map
               (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest
                 (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap))))
               src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
             word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))" let ?m = "ctes_of s" let ?prv = "\<lambda>cte. mdbPrev (cteMDBNode cte)" let ?nxt = "\<lambda>cte. mdbNext (cteMDBNode cte)" assume "pspace_distinct' s" and "pspace_aligned' s" and srcdest: "src \<noteq> dest"
     and dest0: "dest \<noteq> 0"
     and cofs: "ctes_of s src = Some ?c1" and cofd: "ctes_of s dest = Some ?c2"
     and is_der: "is_derived' (ctes_of s) src cap src_cap"
     and aligned: "capAligned cap"
     and vd: "valid_dlist ?m"
     and no0: "?m 0 = None"
     and chain: "mdb_chain_0 ?m"
     and badges: "valid_badges ?m"
     and chunk: "mdb_chunked ?m"
     and contained: "caps_contained' ?m"
     and untyped_mdb: "untyped_mdb' ?m"
     and untyped_inc: "untyped_inc' ?m"
     and class_links: "class_links ?m"
     and distinct_zombies: "distinct_zombies ?m"
     and irq: "irq_control ?m"
     and reply_masters_rvk_fb: "reply_masters_rvk_fb ?m"
     and vn: "valid_nullcaps ?m"
     and ut_rev:"ut_revocable' ?m" have no_loop: "no_loops ?m" apply (rule mdb_chain_0_no_loops[OF chain]) apply (simp add:no_0_def no0) done have badge: "badge_derived' cap src_cap" using is_der by (clarsimp simp:is_derived'_def) have vmdb: "valid_mdb_ctes ?m" by (auto simp: vmdb_def valid_mdb_ctes_def no_0_def, fact+) have src0: "src \<noteq> 0" using cofs no0 by clarsimp have destnull:
    "cte_mdb_prop ?m dest (\<lambda>m. mdbPrev m = 0 \<and> mdbNext m = 0)" using cofd unfolding cte_mdb_prop_def by auto have srcwd: "?m \<turnstile> src \<leadsto> word1" using cofs by (simp add: next_unfold') have w1ned[simp]: "word1 \<noteq> dest" proof (cases "word1 = 0") case True thus ?thesis using dest0 by auto next case False thus ?thesis using cofs cofd src0 dest0 False vd by - (erule (1) valid_dlistEn, (clarsimp simp: nullPointer_def)+) qed have w2ned[simp]: "word2 \<noteq> dest" proof (cases "word2 = 0") case True thus ?thesis using dest0 by auto next case False thus ?thesis using cofs cofd src0 dest0 False vd by - (erule (1) valid_dlistEp, (clarsimp simp: nullPointer_def)+) qed have w1nes[simp]: "word1 \<noteq> src" using vmdb cofs by - (drule (1) no_self_loop_next, simp) have w2nes[simp]: "word2 \<noteq> src" using vmdb cofs by - (drule (1) no_self_loop_prev, simp) from is_der have notZomb1: "\<not> isZombie cap" by (clarsimp simp: isCap_simps is_derived'_def badge_derived'_def) from is_der have notZomb2: "\<not> isZombie src_cap" by (clarsimp simp: isCap_simps is_derived'_def) from badge have masters: "capMasterCap cap = capMasterCap src_cap" by (clarsimp simp: badge_derived'_def) note blah[simp] = w2nes[symmetric] w1nes[symmetric] w1ned[symmetric]
    w2ned[symmetric] srcdest srcdest[symmetric] have mdb_next_disj:
   "\<And>p p'. (?C \<turnstile> p \<leadsto> p' \<Longrightarrow>
   ?m \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p'\<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)
   \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1)" apply (case_tac "p = src") apply (clarsimp simp:mdb_next_unfold modify_map_cases) apply (case_tac "p = dest") apply (clarsimp simp:mdb_next_unfold modify_map_cases)+ using cofs cofd vd no0 apply - apply (case_tac "p = word1") apply clarsimp apply (intro conjI) apply clarsimp apply (frule_tac p = "word1" and m = "?m" in valid_dlist_nextD) apply clarsimp+ apply (frule_tac p = "mdbNext node" and m = "?m" in valid_dlist_nextD) apply clarsimp+ apply (frule_tac p = "mdbNext node" in no_loops_no_l2_loop[OF _ no_loop]) apply simp+ apply (intro conjI) apply clarsimp apply (frule_tac p = p and m = "?m" in valid_dlist_nextD) apply (clarsimp+)[3] apply (intro impI) apply (rule ccontr) apply clarsimp apply (frule_tac p = src and m = "?m" in valid_dlist_nextD) apply clarsimp+ apply (frule_tac p = p and m = "?m" in valid_dlist_nextD) apply clarsimp+ done have ctes_ofD:
   "\<And>p cte. \<lbrakk>?C p = Some cte; p\<noteq> dest; p\<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cteb. (?m p = Some cteb \<and> cteCap cte = cteCap cteb)" by (clarsimp simp:modify_map_def split:if_splits) show "valid_badges ?C" using srcdest badge cofs badges cofd unfolding valid_badges_def apply (intro impI allI) apply (drule mdb_next_disj) apply (elim disjE) defer apply (clarsimp simp:modify_map_cases dest0 src0) apply (clarsimp simp:revokable'_def badge_derived'_def) subgoal by (case_tac src_cap,auto simp:isCap_simps sameRegionAs_def) apply (clarsimp simp:modify_map_cases valid_badges_def) apply (frule_tac x=src in spec, erule_tac x=word1 in allE, erule allE, erule impE) apply fastforce apply simp apply (clarsimp simp:mdb_next_unfold badge_derived'_def split: if_split_asm) apply (thin_tac "All P" for P) subgoal by (cases src_cap,
       auto simp:mdb_next_unfold isCap_simps sameRegionAs_def Let_def split: if_splits) apply (case_tac "word1 = p'") apply (clarsimp simp:modify_map_cases valid_badges_def mdb_next_unfold src0 dest0 no0)+ apply (case_tac "p = dest") apply (clarsimp simp:dest0 src0 no0)+ apply (case_tac z) apply (rename_tac capability mdbnode) apply clarsimp apply (drule_tac x = p in spec,drule_tac x = "mdbNext mdbnode" in spec) by (auto simp:isCap_simps sameRegionAs_def) from badge have isUntyped_eq: "isUntypedCap cap = isUntypedCap src_cap" apply (clarsimp simp:badge_derived'_def) apply (case_tac cap,auto simp:isCap_simps) done from badge have [simp]: "capRange cap = capRange src_cap" apply (clarsimp simp:badge_derived'_def) apply (case_tac cap) apply (clarsimp simp:isCap_simps capRange_def)+ 
    (* 5 subgoals *)
     apply (rename_tac arch_capability) apply (case_tac arch_capability) 
     (* 9 subgoals *)
      apply (clarsimp simp:isCap_simps capRange_def)+ done have [simp]: "untypedRange cap = untypedRange src_cap" using badge apply (clarsimp simp:badge_derived'_def dest!:capMaster_untypedRange) done from contained badge srcdest cofs cofd is_der no0 show "caps_contained' ?C" apply (clarsimp simp add: caps_contained'_def) apply (case_tac "p = dest") apply (case_tac "p' = dest") apply (clarsimp simp:modify_map_def split:if_splits) apply (case_tac src_cap,auto)[1] apply (case_tac "p' = src") apply (clarsimp simp:modify_map_def split:if_splits) apply (clarsimp simp:badge_derived'_def) apply (case_tac src_cap,auto)[1] apply (drule(2) ctes_ofD) apply (clarsimp simp:modify_map_def split:if_splits) apply (frule capRange_untyped) apply (erule_tac x=src in allE, erule_tac x=p' in allE, simp) apply (case_tac cteb) apply (clarsimp) apply blast apply (case_tac "p' = dest") apply (case_tac "p = src") apply (clarsimp simp:modify_map_def split:if_splits) apply (drule capRange_untyped) subgoal by (case_tac cap,auto simp:isCap_simps badge_derived'_def) apply (clarsimp simp:modify_map_def split:if_splits) apply (drule_tac x = word1 in spec) apply (drule_tac x = src in spec) apply (case_tac z) apply (clarsimp simp:isUntyped_eq) apply blast apply (drule_tac x = p in spec) apply (drule_tac x = src in spec) apply (frule capRange_untyped) apply (clarsimp simp:isUntyped_eq) apply blast apply (drule_tac x = p in spec) apply (drule_tac x = p' in spec) apply (clarsimp simp:modify_map_def split:if_splits) apply ((case_tac z,fastforce)+)[5] by fastforce+ show "valid_nullcaps ?C" using is_der vn cofs vd no0 apply (simp add: valid_nullcaps_def srcdest [symmetric]) apply (clarsimp simp:modify_map_def is_derived'_def) apply (rule conjI) apply (clarsimp simp: is_derived'_def badge_derived'_def)+ apply (drule_tac x = word1 in spec) apply (case_tac z) apply (clarsimp simp:nullMDBNode_def) apply (drule(1) valid_dlist_nextD) apply simp apply clarsimp apply (simp add:nullPointer_def src0) done from vmdb srcdest cofs ut_rev show "ut_revocable' ?C" apply (clarsimp simp: valid_mdb_ctes_def ut_revocable'_def modify_map_def) apply (rule conjI) apply clarsimp apply (clarsimp simp: revokable'_def isCap_simps)+ apply auto apply (drule_tac x= src in spec) apply clarsimp apply (case_tac z) apply clarsimp done from class_links srcdest badge cofs cofd no0 vd show "class_links ?C" unfolding class_links_def apply (intro allI impI) apply (drule mdb_next_disj) apply (elim disjE) apply (clarsimp simp:modify_map_def mdb_next_unfold split:if_split_asm) apply (clarsimp simp: badge_derived'_def modify_map_def
    split: if_split_asm) apply (erule capMaster_capClass) apply (clarsimp simp:modify_map_def split:if_splits) apply (drule_tac x = src in spec) apply (drule_tac x = word1 in spec) apply (clarsimp simp:mdb_next_unfold) apply (case_tac z) apply (clarsimp simp:badge_derived'_def) apply (drule capMaster_capClass) apply simp done from distinct_zombies badge show "distinct_zombies ?C" apply (simp add:distinct_zombies_nonCTE_modify_map) apply (erule_tac distinct_zombies_copyMasterE[where x=src]) apply (rule cofs) apply (simp add: masters) apply (simp add: notZomb1 notZomb2) done from reply_masters_rvk_fb is_der show "reply_masters_rvk_fb ?C" apply (clarsimp simp:reply_masters_rvk_fb_def) apply (erule ranE) apply (clarsimp simp:modify_map_def split:if_split_asm) apply fastforce+ apply (clarsimp simp:is_derived'_def isCap_simps) apply fastforce done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)\<rbrace> cteInsert cap src dest \<lbrace>\<lambda>_. valid_mdb'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)\<rbrace> cteInsert cap src dest \<lbrace>\<lambda>_ s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>(\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)\<rbrace> cteInsert cap src dest \<lbrace>\<lambda>r s. valid_dlist (ctes_of s) \<and> irq_control (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> ?Q4 s\<rbrace>
 2. \<And>rv s. valid_dlist (ctes_of s) \<and> irq_control (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> ?Q4 s \<Longrightarrow> valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) proof (prove)
goal (2 subgoals):
 1. \<And>rv s. valid_dlist (ctes_of s) \<and> irq_control (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> ?Q4 s \<Longrightarrow> valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)
 2. \<lbrace>(\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)\<rbrace> cteInsert cap src dest \<lbrace>\<lambda>r s. valid_dlist (ctes_of s) \<and> irq_control (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> ?Q4 s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>valid_dlist (ctes_of s); irq_control (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); ?Q4 s\<rbrakk> \<Longrightarrow> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)
 2. \<lbrace>(\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)\<rbrace> cteInsert cap src dest \<lbrace>\<lambda>r s. valid_dlist (ctes_of s) \<and> irq_control (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> ?Q4 s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)\<rbrace> cteInsert cap src dest \<lbrace>\<lambda>r s. valid_dlist (ctes_of s) \<and> irq_control (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. ((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s \<Longrightarrow> \<lbrace>(=) s\<rbrace> cteInsert cap src dest \<lbrace>\<lambda>r s. valid_dlist (ctes_of s) \<and> irq_control (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. ((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s \<Longrightarrow> \<lbrace>?P'32 s\<rbrace> cteInsert cap src dest \<lbrace>\<lambda>rv s. valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)\<rbrace>
 2. \<And>s sa. \<lbrakk>((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s; s = sa\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and valid_objs' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> ?P'32 s sa proof (prove)
goal (2 subgoals):
 1. \<And>s. ((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s \<Longrightarrow> \<lbrace>?P'32 s\<rbrace> do srcCTE <- getCTE src;
srcMDB <- return (cteMDBNode srcCTE);
srcCap <- return (cteCap srcCTE);
newCapIsRevocable <- return (revokable' srcCap cap);
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src) srcMDB)));
oldCTE <- getCTE dest;
haskell_assert (isNullCap $ cteCap oldCTE) [];
haskell_assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer) [];
setUntypedCapAsFull srcCap cap src;
updateCap dest cap;
updateMDB dest (const newMDB);
updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od \<lbrace>\<lambda>rv s. valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)\<rbrace>
 2. \<And>s sa. \<lbrakk>((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s; s = sa\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and valid_objs' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> ?P'32 s sa proof (prove)
goal (2 subgoals):
 1. \<And>s. ((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s \<Longrightarrow> \<lbrace>?P'32 s\<rbrace> do srcCTE <- getCTE src;
srcMDB <- return (cteMDBNode srcCTE);
srcCap <- return (cteCap srcCTE);
newCapIsRevocable <- return (revokable' srcCap cap);
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src) srcMDB)));
oldCTE <- getCTE dest;
haskell_assert (isNullCap $ cteCap oldCTE) [];
haskell_assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer) [];
setUntypedCapAsFull srcCap cap src;
do cte <- getCTE dest;
setCTE dest (cteCap_update (\<lambda>_. cap) cte)
od;
updateMDB dest (const newMDB);
updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest))
od \<lbrace>\<lambda>rv s. valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)\<rbrace>
 2. \<And>s sa. \<lbrakk>((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s; s = sa\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and valid_objs' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> ?P'32 s sa proof (prove)
goal (2 subgoals):
 1. \<And>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?P'32 s\<rbrace> do srcCTE <- getCTE src;
oldCTE <- getCTE dest;
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull (cteCap srcCTE) cap src;
y <- do cte <- getCTE dest;
setCTE dest (cteCap_update (\<lambda>_. cap) cte)
od;
y <- updateMDB dest (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE)))));
y <- updateMDB src (mdbNext_update (\<lambda>_. dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. dest))
od \<lbrace>\<lambda>rv s. valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)\<rbrace>
 2. \<And>s sa. \<lbrakk>((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s; s = sa\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and valid_objs' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> ?P'32 s sa proof (prove)
goal (6 subgoals):
 1. \<And>s srcCTE x y ya. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?B38 s srcCTE x y ya\<rbrace> setUntypedCapAsFull (cteCap srcCTE) cap src \<lbrace>\<lambda>yb s. \<forall>cte. cte_wp_at' ((=) cte) dest s \<longrightarrow> no_0 ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) \<and> no_0 (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) \<and> no_0 (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE))))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))\<rbrace>
 2. \<And>s srcCTE x y. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?B37 s srcCTE x y\<rbrace> assert (mdbPrev (cteMDBNode x) = nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer) \<lbrace>?B38 s srcCTE x y\<rbrace>
 3. \<And>s srcCTE x. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?B36 s srcCTE x\<rbrace> assert (cteCap x = capability.NullCap) \<lbrace>?B37 s srcCTE x\<rbrace>
 4. \<And>s srcCTE. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?B35 s srcCTE\<rbrace> getCTE dest \<lbrace>?B36 s srcCTE\<rbrace>
 5. \<And>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?P'32 s\<rbrace> getCTE src \<lbrace>?B35 s\<rbrace>
 6. \<And>s sa. \<lbrakk>((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s; s = sa\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and valid_objs' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> ?P'32 s sa proof (prove)
goal (6 subgoals):
 1. \<And>s srcCTE x cte. \<lbrakk>valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some cte; is_derived' (ctes_of s) src cap (cteCap cte)\<rbrakk> \<Longrightarrow> \<lbrace>?B38 s srcCTE x () ()\<rbrace> setUntypedCapAsFull (cteCap srcCTE) cap src \<lbrace>\<lambda>yb s. \<forall>cte. ctes_of s dest = Some cte \<longrightarrow> no_0 ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> cteCap_update (\<lambda>_. cap) cte)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode srcCTE)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))\<rbrace>
 2. \<And>s srcCTE x y. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?B37 s srcCTE x y\<rbrace> assert (mdbPrev (cteMDBNode x) = nullPointer \<and> mdbNext (cteMDBNode x) = nullPointer) \<lbrace>?B38 s srcCTE x y\<rbrace>
 3. \<And>s srcCTE x. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?B36 s srcCTE x\<rbrace> assert (cteCap x = capability.NullCap) \<lbrace>?B37 s srcCTE x\<rbrace>
 4. \<And>s srcCTE. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?B35 s srcCTE\<rbrace> getCTE dest \<lbrace>?B36 s srcCTE\<rbrace>
 5. \<And>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' s \<and> cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s \<Longrightarrow> \<lbrace>?P'32 s\<rbrace> getCTE src \<lbrace>?B35 s\<rbrace>
 6. \<And>s sa. \<lbrakk>((\<lambda>s. valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s)) and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>y. capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) s; s = sa\<rbrakk> \<Longrightarrow> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and K (capAligned cap) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_aligned' and pspace_distinct' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> (valid_mdb' and pspace_distinct' and pspace_aligned' and valid_objs' and (\<lambda>s. src \<noteq> dest) and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) src cap \<circ> cteCap) src s)) sa \<and> ?P'32 s sa proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>valid_dlist (ctes_of sa) \<and> no_0 (ctes_of sa) \<and> mdb_chain_0 (ctes_of sa) \<and> valid_badges (ctes_of sa) \<and> caps_contained' (ctes_of sa) \<and> mdb_chunked (ctes_of sa) \<and> untyped_mdb' (ctes_of sa) \<and> untyped_inc' (ctes_of sa) \<and> valid_nullcaps (ctes_of sa) \<and> ut_revocable' (ctes_of sa) \<and> class_links (ctes_of sa) \<and> distinct_zombies (ctes_of sa) \<and> irq_control (ctes_of sa) \<and> reply_masters_rvk_fb (ctes_of sa) \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> src \<noteq> dest \<and> capAligned cap \<and> valid_objs' sa \<and> cte_wp_at' (is_derived' (ctes_of sa) src cap \<circ> cteCap) src sa; s = sa\<rbrakk> \<Longrightarrow> valid_mdb' sa \<and> (cte_wp_at' (\<lambda>_. True) src sa \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) src sa) \<and> \<not> cte_wp_at' (\<lambda>_. True) dest sa \<or> (\<forall>x. \<exists>cte. cte_wp_at' ((=) cte) src sa \<and> (\<exists>ctea. cte_wp_at' ((=) ctea) dest sa \<and> (cteCap ctea = capability.NullCap \<longrightarrow> ctes_of sa dest = Some x \<longrightarrow> mdbPrev (cteMDBNode ctea) = nullPointer \<longrightarrow> mdbNext (cteMDBNode ctea) = nullPointer \<longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> cte_wp_at' ((=) cte) src sa \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> cte_wp_at' (\<lambda>c. c = cte) src sa \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> cte_wp_at' (\<lambda>c. c = cte) src sa \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> cte_wp_at' (\<lambda>c. c = cte) src sa \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> cte_wp_at' (\<lambda>c. c = cte) src sa \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> cte_wp_at' (\<lambda>c. c = cte) src sa \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> cte_wp_at' (\<lambda>c. c = cte) src sa \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> cte_wp_at' (\<lambda>c. c = cte) src sa)))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte)\<rbrakk> \<Longrightarrow> valid_mdb' sa \<and> (ctes_of sa dest = None \<or> (\<forall>x. \<exists>ctea. ctes_of sa dest = Some ctea \<and> (cteCap ctea = capability.NullCap \<longrightarrow> ctes_of sa dest = Some x \<longrightarrow> mdbPrev (cteMDBNode ctea) = nullPointer \<longrightarrow> mdbNext (cteMDBNode ctea) = nullPointer \<longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte)\<rbrakk> \<Longrightarrow> valid_mdb' sa \<and> (ctes_of sa dest = None \<or> (\<forall>x. \<exists>ctea. ctes_of sa dest = Some ctea \<and> (cteCap ctea = capability.NullCap \<longrightarrow> ctes_of sa dest = Some x \<longrightarrow> mdbPrev (cteMDBNode ctea) = nullPointer \<longrightarrow> mdbNext (cteMDBNode ctea) = nullPointer \<longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte x. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte); ctes_of sa dest = Some x; cteCap x = capability.NullCap; mdbPrev (cteMDBNode x) = nullPointer; mdbNext (cteMDBNode x) = nullPointer\<rbrakk> \<Longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte x x1 x2. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte); ctes_of sa dest = Some x; cteCap x = capability.NullCap; mdbPrev (cteMDBNode x) = nullPointer; mdbNext (cteMDBNode x) = nullPointer; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte x cap1 node1. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte); ctes_of sa dest = Some x; cteCap x = capability.NullCap; mdbPrev (cteMDBNode x) = nullPointer; mdbNext (cteMDBNode x) = nullPointer; cte = CTE cap1 node1\<rbrakk> \<Longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte x cap1 node1 x1 x2. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte); ctes_of sa dest = Some x; cteCap x = capability.NullCap; mdbPrev (cteMDBNode x) = nullPointer; mdbNext (cteMDBNode x) = nullPointer; cte = CTE cap1 node1; x = CTE x1 x2\<rbrakk> \<Longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte x cap1 node1 cap2 node2. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte); ctes_of sa dest = Some x; cteCap x = capability.NullCap; mdbPrev (cteMDBNode x) = nullPointer; mdbNext (cteMDBNode x) = nullPointer; cte = CTE cap1 node1; x = CTE cap2 node2\<rbrakk> \<Longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte x cap1 node1 cap2 node2 x1 x2 x3 x4. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte); ctes_of sa dest = Some x; cteCap x = capability.NullCap; mdbPrev (cteMDBNode x) = nullPointer; mdbNext (cteMDBNode x) = nullPointer; cte = CTE cap1 node1; x = CTE cap2 node2; node1 = MDB x1 x2 x3 x4\<rbrakk> \<Longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cte x cap1 node1 cap2 node2 x1 x2 x3 x4 x1a x2a x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); no_0 (ctes_of sa); mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some cte; is_derived' (ctes_of sa) src cap (cteCap cte); ctes_of sa dest = Some x; cteCap x = capability.NullCap; mdbPrev (cteMDBNode x) = nullPointer; mdbNext (cteMDBNode x) = nullPointer; cte = CTE cap1 node1; x = CTE cap2 node2; node1 = MDB x1 x2 x3 x4; node2 = MDB x1a x2a x3a x4a\<rbrakk> \<Longrightarrow> no_0 ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) \<and> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> cteCap_update (\<lambda>_. cap) x)) dest (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbRevocable_update (\<lambda>_. revokable' (cteCap cte) cap) (mdbPrev_update (\<lambda>_. src) (cteMDBNode cte)))))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext (cteMDBNode cte)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a))\<rbrakk> \<Longrightarrow> dest \<noteq> 0 \<and> (dest \<noteq> 0 \<longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) \<and> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))) proof (prove)
goal (8 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a))\<rbrakk> \<Longrightarrow> dest \<noteq> 0
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 8. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (7 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
this:
pspace_distinct' s
pspace_aligned' s
src \<noteq> dest
dest \<noteq> 0
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
is_derived' (ctes_of s) src cap src_cap
capAligned cap
valid_dlist (ctes_of s)
ctes_of s 0 = None
mdb_chain_0 (ctes_of s)
valid_badges (ctes_of s)
mdb_chunked (ctes_of s)
caps_contained' (ctes_of s)
untyped_mdb' (ctes_of s)
untyped_inc' (ctes_of s)
class_links (ctes_of s)
distinct_zombies (ctes_of s)
irq_control (ctes_of s)
reply_masters_rvk_fb (ctes_of s)
valid_nullcaps (ctes_of s)
ut_revocable' (ctes_of s)

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. no_loops (ctes_of s) proof (prove)
goal (1 subgoal):
 1. no_0 (ctes_of s) proof (prove)
goal:
No subgoals! proof (state)
this:
no_loops (ctes_of s)

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. badge_derived' cap src_cap proof (prove)
using this:
is_derived' (ctes_of s) src cap src_cap

goal (1 subgoal):
 1. badge_derived' cap src_cap proof (state)
this:
badge_derived' cap src_cap

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. valid_mdb_ctes (ctes_of s) proof (state)
this:
valid_mdb_ctes (ctes_of s)

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. src \<noteq> 0 proof (prove)
using this:
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s 0 = None

goal (1 subgoal):
 1. src \<noteq> 0 proof (state)
this:
src \<noteq> 0

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. cte_mdb_prop (ctes_of s) dest (\<lambda>m. mdbPrev m = 0 \<and> mdbNext m = 0) proof (prove)
using this:
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))

goal (1 subgoal):
 1. cte_mdb_prop (ctes_of s) dest (\<lambda>m. mdbPrev m = 0 \<and> mdbNext m = 0) proof (prove)
using this:
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))

goal (1 subgoal):
 1. \<exists>cte. ctes_of s dest = Some cte \<and> mdbPrev (cteMDBNode cte) = 0 \<and> mdbNext (cteMDBNode cte) = 0 proof (state)
this:
cte_mdb_prop (ctes_of s) dest (\<lambda>m. mdbPrev m = 0 \<and> mdbNext m = 0)

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. ctes_of s \<turnstile> src \<leadsto> word1 proof (prove)
using this:
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))

goal (1 subgoal):
 1. ctes_of s \<turnstile> src \<leadsto> word1 proof (state)
this:
ctes_of s \<turnstile> src \<leadsto> word1

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. word1 \<noteq> dest proof (state)
goal (2 subgoals):
 1. word1 = 0 \<Longrightarrow> word1 \<noteq> dest
 2. word1 \<noteq> 0 \<Longrightarrow> word1 \<noteq> dest proof (state)
this:
word1 = 0

goal (2 subgoals):
 1. word1 = 0 \<Longrightarrow> word1 \<noteq> dest
 2. word1 \<noteq> 0 \<Longrightarrow> word1 \<noteq> dest proof (prove)
using this:
word1 = 0

goal (1 subgoal):
 1. word1 \<noteq> dest proof (prove)
using this:
word1 = 0
dest \<noteq> 0

goal (1 subgoal):
 1. word1 \<noteq> dest proof (state)
this:
word1 \<noteq> dest

goal (1 subgoal):
 1. word1 \<noteq> 0 \<Longrightarrow> word1 \<noteq> dest proof (state)
goal (1 subgoal):
 1. word1 \<noteq> 0 \<Longrightarrow> word1 \<noteq> dest proof (state)
this:
word1 \<noteq> 0

goal (1 subgoal):
 1. word1 \<noteq> 0 \<Longrightarrow> word1 \<noteq> dest proof (prove)
using this:
word1 \<noteq> 0

goal (1 subgoal):
 1. word1 \<noteq> dest proof (prove)
using this:
word1 \<noteq> 0
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
src \<noteq> 0
dest \<noteq> 0
word1 \<noteq> 0
valid_dlist (ctes_of s)

goal (1 subgoal):
 1. word1 \<noteq> dest proof (state)
this:
word1 \<noteq> dest

goal:
No subgoals! proof (state)
this:
word1 \<noteq> dest

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. word2 \<noteq> dest proof (state)
goal (2 subgoals):
 1. word2 = 0 \<Longrightarrow> word2 \<noteq> dest
 2. word2 \<noteq> 0 \<Longrightarrow> word2 \<noteq> dest proof (state)
this:
word2 = 0

goal (2 subgoals):
 1. word2 = 0 \<Longrightarrow> word2 \<noteq> dest
 2. word2 \<noteq> 0 \<Longrightarrow> word2 \<noteq> dest proof (prove)
using this:
word2 = 0

goal (1 subgoal):
 1. word2 \<noteq> dest proof (prove)
using this:
word2 = 0
dest \<noteq> 0

goal (1 subgoal):
 1. word2 \<noteq> dest proof (state)
this:
word2 \<noteq> dest

goal (1 subgoal):
 1. word2 \<noteq> 0 \<Longrightarrow> word2 \<noteq> dest proof (state)
goal (1 subgoal):
 1. word2 \<noteq> 0 \<Longrightarrow> word2 \<noteq> dest proof (state)
this:
word2 \<noteq> 0

goal (1 subgoal):
 1. word2 \<noteq> 0 \<Longrightarrow> word2 \<noteq> dest proof (prove)
using this:
word2 \<noteq> 0

goal (1 subgoal):
 1. word2 \<noteq> dest proof (prove)
using this:
word2 \<noteq> 0
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
src \<noteq> 0
dest \<noteq> 0
word2 \<noteq> 0
valid_dlist (ctes_of s)

goal (1 subgoal):
 1. word2 \<noteq> dest proof (state)
this:
word2 \<noteq> dest

goal:
No subgoals! proof (state)
this:
word2 \<noteq> dest

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. word1 \<noteq> src proof (prove)
using this:
valid_mdb_ctes (ctes_of s)
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))

goal (1 subgoal):
 1. word1 \<noteq> src proof (state)
this:
word1 \<noteq> src

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. word2 \<noteq> src proof (prove)
using this:
valid_mdb_ctes (ctes_of s)
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))

goal (1 subgoal):
 1. word2 \<noteq> src proof (state)
this:
word2 \<noteq> src

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
is_derived' (ctes_of s) src cap src_cap proof (prove)
using this:
is_derived' (ctes_of s) src cap src_cap

goal (1 subgoal):
 1. \<not> isZombie cap proof (state)
this:
\<not> isZombie cap

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
is_derived' (ctes_of s) src cap src_cap proof (prove)
using this:
is_derived' (ctes_of s) src cap src_cap

goal (1 subgoal):
 1. \<not> isZombie src_cap proof (state)
this:
\<not> isZombie src_cap

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
badge_derived' cap src_cap proof (prove)
using this:
badge_derived' cap src_cap

goal (1 subgoal):
 1. capMasterCap cap = capMasterCap src_cap proof (state)
this:
capMasterCap cap = capMasterCap src_cap

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (state)
this:
src \<noteq> word2
src \<noteq> word1
dest \<noteq> word1
dest \<noteq> word2
src \<noteq> dest
dest \<noteq> src

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>p p'. modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p' \<Longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0) \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1 proof (prove)
goal (2 subgoals):
 1. \<And>p p'. \<lbrakk>modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p'; p = src\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0) \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1
 2. \<And>p p'. \<lbrakk>modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p'; p \<noteq> src\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0) \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1 proof (prove)
goal (1 subgoal):
 1. \<And>p p'. \<lbrakk>modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p'; p \<noteq> src\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0) \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1 proof (prove)
goal (2 subgoals):
 1. \<And>p p'. \<lbrakk>modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p'; p \<noteq> src; p = dest\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0) \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1
 2. \<And>p p'. \<lbrakk>modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p'; p \<noteq> src; p \<noteq> dest\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0) \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1 proof (prove)
goal (1 subgoal):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z)\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
using this:
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
valid_dlist (ctes_of s)
ctes_of s 0 = None

goal (1 subgoal):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z)\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (1 subgoal):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (2 subgoals):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p = word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0)
 2. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> dest \<and> (mdbNext node = word1 \<longrightarrow> word1 = 0)
 2. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> dest
 2. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = word1 \<longrightarrow> word1 = 0
 3. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s (mdbNext node) = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node); dest = mdbNext node\<rbrakk> \<Longrightarrow> False
 2. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = word1 \<longrightarrow> word1 = 0
 3. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (5 subgoals):
 1. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s (mdbNext node) = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node); dest = mdbNext node\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s)
 2. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s (mdbNext node) = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node); dest = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE cap node)) \<noteq> 0
 3. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s (mdbNext node) = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node); dest = mdbNext node; \<exists>cte'. ctes_of s (mdbNext (cteMDBNode (CTE cap node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = word1\<rbrakk> \<Longrightarrow> False
 4. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s word1 = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = word1 \<longrightarrow> word1 = 0
 5. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB (mdbNext node) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s (mdbNext node) = Some (CTE cap node); word1 = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext node = 0
 2. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (4 subgoals):
 1. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB (mdbNext node) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s (mdbNext node) = Some (CTE cap node); word1 = mdbNext node\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s)
 2. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB (mdbNext node) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s (mdbNext node) = Some (CTE cap node); word1 = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE cap node)) \<noteq> 0
 3. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB (mdbNext node) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s (mdbNext node) = Some (CTE cap node); word1 = mdbNext node; \<exists>cte'. ctes_of s (mdbNext (cteMDBNode (CTE cap node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext node = 0
 4. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB (mdbNext node) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s (mdbNext node) = Some (CTE cap node); word1 = mdbNext node; mdbPrev node = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext node = 0
 2. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (4 subgoals):
 1. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB (mdbNext node) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s (mdbNext node) = Some (CTE cap node); word1 = mdbNext node; mdbPrev node = mdbNext node\<rbrakk> \<Longrightarrow> ctes_of s (mdbNext node) = Some (?cte62 cap node)
 2. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB (mdbNext node) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s (mdbNext node) = Some (CTE cap node); word1 = mdbNext node; mdbPrev node = mdbNext node\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode (?cte62 cap node)) = mdbNext (cteMDBNode (?cte62 cap node))
 3. \<And>cap node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB (mdbNext node) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; ctes_of s (mdbNext node) = Some (CTE cap node); word1 = mdbNext node; mdbPrev node = mdbNext node; mdbNext (cteMDBNode (?cte62 cap node)) = 0\<rbrakk> \<Longrightarrow> mdbNext node = 0
 4. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; word1 \<noteq> p \<longrightarrow> ctes_of s p = Some z; word1 = p \<longrightarrow> (\<exists>cap node. ctes_of s p = Some (CTE cap node) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> (\<exists>za. ctes_of s p = Some za \<and> mdbNext (cteMDBNode z) = mdbNext (cteMDBNode za)) \<and> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (1 subgoal):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) \<noteq> dest \<and> (mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0) proof (prove)
goal (2 subgoals):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) \<noteq> dest
 2. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0 proof (prove)
goal (2 subgoals):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> mdbNext (cteMDBNode z); ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1; dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> False
 2. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0 proof (prove)
goal (4 subgoals):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> mdbNext (cteMDBNode z); ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1; dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s)
 2. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> mdbNext (cteMDBNode z); ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1; dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) \<noteq> 0
 3. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> mdbNext (cteMDBNode z); ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1; dest = mdbNext (cteMDBNode z); \<exists>cte'. ctes_of s (mdbNext (cteMDBNode z)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 4. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0 proof (prove)
goal (1 subgoal):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = word1 \<longrightarrow> word1 = 0 proof (prove)
goal (1 subgoal):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1; mdbNext (cteMDBNode z) = word1\<rbrakk> \<Longrightarrow> word1 = 0 proof (prove)
goal (1 subgoal):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> word1; mdbNext (cteMDBNode z) = word1; word1 \<noteq> 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> mdbNext (cteMDBNode z); mdbNext (cteMDBNode z) \<noteq> 0; word1 = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> mdbNext (cteMDBNode z); mdbNext (cteMDBNode z) \<noteq> 0; word1 = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s)
 2. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> mdbNext (cteMDBNode z); mdbNext (cteMDBNode z) \<noteq> 0; word1 = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a))) \<noteq> 0
 3. \<And>p z. \<lbrakk>p \<noteq> src; p \<noteq> dest; ctes_of s p = Some z; ctes_of s src = Some (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> mdbNext (cteMDBNode z); mdbNext (cteMDBNode z) \<noteq> 0; word1 = mdbNext (cteMDBNode z); \<exists>cte'. ctes_of s (mdbNext (cteMDBNode (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>p z cte'. \<lbrakk>p \<noteq> mdbPrev (cteMDBNode cte'); p \<noteq> dest; ctes_of s p = Some z; ctes_of s (mdbPrev (cteMDBNode cte')) = Some (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> mdbNext (cteMDBNode z); mdbNext (cteMDBNode z) \<noteq> 0; word1 = mdbNext (cteMDBNode z); ctes_of s (mdbNext (cteMDBNode z)) = Some cte'; src = mdbPrev (cteMDBNode cte')\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>p z cte'. \<lbrakk>p \<noteq> mdbPrev (cteMDBNode cte'); p \<noteq> dest; ctes_of s p = Some z; ctes_of s (mdbPrev (cteMDBNode cte')) = Some (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> mdbNext (cteMDBNode z); mdbNext (cteMDBNode z) \<noteq> 0; word1 = mdbNext (cteMDBNode z); ctes_of s (mdbNext (cteMDBNode z)) = Some cte'; src = mdbPrev (cteMDBNode cte')\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s)
 2. \<And>p z cte'. \<lbrakk>p \<noteq> mdbPrev (cteMDBNode cte'); p \<noteq> dest; ctes_of s p = Some z; ctes_of s (mdbPrev (cteMDBNode cte')) = Some (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> mdbNext (cteMDBNode z); mdbNext (cteMDBNode z) \<noteq> 0; word1 = mdbNext (cteMDBNode z); ctes_of s (mdbNext (cteMDBNode z)) = Some cte'; src = mdbPrev (cteMDBNode cte')\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) \<noteq> 0
 3. \<And>p z cte'. \<lbrakk>p \<noteq> mdbPrev (cteMDBNode cte'); p \<noteq> dest; ctes_of s p = Some z; ctes_of s (mdbPrev (cteMDBNode cte')) = Some (CTE src_cap (MDB (mdbNext (cteMDBNode z)) word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); valid_dlist (ctes_of s); ctes_of s 0 = None; p \<noteq> mdbNext (cteMDBNode z); mdbNext (cteMDBNode z) \<noteq> 0; word1 = mdbNext (cteMDBNode z); ctes_of s (mdbNext (cteMDBNode z)) = Some cte'; src = mdbPrev (cteMDBNode cte'); \<exists>cte'. ctes_of s (mdbNext (cteMDBNode z)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> ?p \<leadsto> ?p' \<Longrightarrow> ctes_of s \<turnstile> ?p \<leadsto> ?p' \<and> ?p \<noteq> src \<and> ?p' \<noteq> dest \<and> (?p' = word1 \<longrightarrow> ?p' = 0) \<or> ?p = src \<and> ?p' = dest \<or> ?p = dest \<and> ?p' = word1

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cteb. ctes_of s p = Some cteb \<and> cteCap cte = cteCap cteb proof (state)
this:
\<lbrakk>modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) ?p = Some ?cte; ?p \<noteq> dest; ?p \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cteb. ctes_of s ?p = Some cteb \<and> cteCap ?cte = cteCap cteb

goal (7 subgoals):
 1. \<And>s src_cap word1 word2 bool1a bool2a bool1 bool2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; src \<noteq> dest; capAligned cap; valid_objs' s; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); is_derived' (ctes_of s) src cap src_cap; ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 7. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
using this:
src \<noteq> dest
badge_derived' cap src_cap
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
valid_badges (ctes_of s)
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))

goal (1 subgoal):
 1. valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
using this:
src \<noteq> dest
badge_derived' cap src_cap
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
\<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))

goal (1 subgoal):
 1. \<forall>p p' capa node cap' node'. modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node) \<longrightarrow> modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node') \<longrightarrow> modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs capa cap' \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p'; global.sameRegionAs capa cap'\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0) \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (3 subgoals):
 1. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; p = src \<and> p' = dest\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (3 subgoals):
 1. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; p = src \<and> p' = dest\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (3 subgoals):
 1. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs src_cap cap\<rbrakk> \<Longrightarrow> (isEndpointCap src_cap \<longrightarrow> capEPBadge src_cap \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> revokable' src_cap cap) \<and> (isNotificationCap src_cap \<longrightarrow> capNtfnBadge src_cap \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> revokable' src_cap cap)
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs src_cap cap; capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> (isEndpointCap src_cap \<longrightarrow> capEPBadge src_cap \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge src_cap | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap src_cap | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge src_cap | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap src_cap | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) \<and> (isNotificationCap src_cap \<longrightarrow> capNtfnBadge src_cap \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge src_cap | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap src_cap | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge src_cap | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap src_cap | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False))
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs src_cap cap; capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> (isEndpointCap src_cap \<longrightarrow> capEPBadge src_cap \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge src_cap | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap src_cap | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge src_cap | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap src_cap | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) \<and> (isNotificationCap src_cap \<longrightarrow> capNtfnBadge src_cap \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge src_cap | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap src_cap | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge src_cap | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap src_cap | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) proof (prove)
goal (2 subgoals):
 1. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (2 subgoals):
 1. \<And>cap' node. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs cap cap'; ctes_of s word1 = Some (CTE cap' node)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node)
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (3 subgoals):
 1. \<And>cap' node. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs cap cap'; ctes_of s word1 = Some (CTE cap' node)\<rbrakk> \<Longrightarrow> \<exists>nodea. ctes_of s src = Some (CTE (?cap38 cap' node) nodea)
 2. \<And>cap' node. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs cap cap'; ctes_of s word1 = Some (CTE cap' node); \<forall>cap'a node'. ctes_of s word1 = Some (CTE cap'a node') \<longrightarrow> ctes_of s \<turnstile> src \<leadsto> word1 \<longrightarrow> global.sameRegionAs (?cap38 cap' node) cap'a \<longrightarrow> (isEndpointCap (?cap38 cap' node) \<longrightarrow> capEPBadge (?cap38 cap' node) \<noteq> capEPBadge cap'a \<longrightarrow> capEPBadge cap'a \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap (?cap38 cap' node) \<longrightarrow> capNtfnBadge (?cap38 cap' node) \<noteq> capNtfnBadge cap'a \<longrightarrow> capNtfnBadge cap'a \<noteq> 0 \<longrightarrow> mdbFirstBadged node')\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node)
 3. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (2 subgoals):
 1. \<And>cap' node. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs cap cap'; ctes_of s word1 = Some (CTE cap' node); \<forall>cap' node'. ctes_of s word1 = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> src \<leadsto> word1 \<longrightarrow> global.sameRegionAs src_cap cap' \<longrightarrow> (isEndpointCap src_cap \<longrightarrow> capEPBadge src_cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap src_cap \<longrightarrow> capNtfnBadge src_cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node)
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (2 subgoals):
 1. \<And>cap' node. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs cap cap'; ctes_of s word1 = Some (CTE cap' node); ctes_of s \<turnstile> src \<leadsto> word1 \<longrightarrow> global.sameRegionAs src_cap cap' \<longrightarrow> (isEndpointCap src_cap \<longrightarrow> capEPBadge src_cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap src_cap \<longrightarrow> capNtfnBadge src_cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node)
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (2 subgoals):
 1. \<And>cap' node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> (\<exists>z. ctes_of s p = Some z \<and> p' = mdbNext (cteMDBNode z)) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs cap cap'; ctes_of s word1 = Some (CTE cap' node); global.sameRegionAs src_cap cap' \<longrightarrow> (isEndpointCap src_cap \<longrightarrow> capEPBadge src_cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap src_cap \<longrightarrow> capNtfnBadge src_cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node)
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (2 subgoals):
 1. \<And>cap' node. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs cap cap'; ctes_of s word1 = Some (CTE cap' node); global.sameRegionAs src_cap cap' \<longrightarrow> (isEndpointCap src_cap \<longrightarrow> capEPBadge src_cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap src_cap \<longrightarrow> capNtfnBadge src_cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node) \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node)
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs cap cap'_; ctes_of s word1 = Some (CTE cap'_ node_); global.sameRegionAs src_cap cap'_ \<longrightarrow> (isEndpointCap src_cap \<longrightarrow> capEPBadge src_cap \<noteq> capEPBadge cap'_ \<longrightarrow> capEPBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node_) \<and> (isNotificationCap src_cap \<longrightarrow> capNtfnBadge src_cap \<noteq> capNtfnBadge cap'_ \<longrightarrow> capNtfnBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node_); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap'_ \<longrightarrow> capEPBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node_) \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap'_ \<longrightarrow> capNtfnBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node_) proof (prove)
goal (1 subgoal):
 1. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (2 subgoals):
 1. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0); word1 = p'\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>p p' capa node cap' node'. \<lbrakk>src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node cap' node'. ctes_of s p = Some (CTE cap node) \<longrightarrow> ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capa node); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE cap' node'); global.sameRegionAs capa cap'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0); word1 \<noteq> p'\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<And>p capa node cap' node' z. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node. ctes_of s p = Some (CTE cap node) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> p' = mdbNext node \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs capa cap'; word1 \<noteq> mdbNext (cteMDBNode z); word1 \<noteq> p \<longrightarrow> (dest \<noteq> p \<longrightarrow> z = CTE capa node) \<and> (dest = p \<longrightarrow> cap = capa \<and> MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap) = node); word1 = p \<longrightarrow> (\<exists>nodea. (dest \<noteq> p \<longrightarrow> z = CTE capa nodea) \<and> (dest = p \<longrightarrow> cap = capa \<and> MDB p src (revokable' src_cap cap) (revokable' src_cap cap) = nodea) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node); src \<noteq> mdbNext (cteMDBNode z) \<longrightarrow> ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node'); src = mdbNext (cteMDBNode z) \<longrightarrow> (\<exists>node. ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node) \<and> mdbNext_update (\<lambda>_. dest) node = node'); p \<noteq> src; mdbNext (cteMDBNode z) \<noteq> dest; ctes_of s p = Some z\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (2 subgoals):
 1. \<And>p capa node cap' node' z. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node. ctes_of s p = Some (CTE cap node) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> p' = mdbNext node \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs capa cap'; word1 \<noteq> mdbNext (cteMDBNode z); word1 \<noteq> p \<longrightarrow> (dest \<noteq> p \<longrightarrow> z = CTE capa node) \<and> (dest = p \<longrightarrow> cap = capa \<and> MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap) = node); word1 = p \<longrightarrow> (\<exists>nodea. (dest \<noteq> p \<longrightarrow> z = CTE capa nodea) \<and> (dest = p \<longrightarrow> cap = capa \<and> MDB p src (revokable' src_cap cap) (revokable' src_cap cap) = nodea) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node); src \<noteq> mdbNext (cteMDBNode z) \<longrightarrow> ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node'); src = mdbNext (cteMDBNode z) \<longrightarrow> (\<exists>node. ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node) \<and> mdbNext_update (\<lambda>_. dest) node = node'); p \<noteq> src; mdbNext (cteMDBNode z) \<noteq> dest; ctes_of s p = Some z; p = dest\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>p capa node cap' node' z. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node. ctes_of s p = Some (CTE cap node) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> p' = mdbNext node \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs capa cap'; word1 \<noteq> mdbNext (cteMDBNode z); word1 \<noteq> p \<longrightarrow> (dest \<noteq> p \<longrightarrow> z = CTE capa node) \<and> (dest = p \<longrightarrow> cap = capa \<and> MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap) = node); word1 = p \<longrightarrow> (\<exists>nodea. (dest \<noteq> p \<longrightarrow> z = CTE capa nodea) \<and> (dest = p \<longrightarrow> cap = capa \<and> MDB p src (revokable' src_cap cap) (revokable' src_cap cap) = nodea) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node); src \<noteq> mdbNext (cteMDBNode z) \<longrightarrow> ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node'); src = mdbNext (cteMDBNode z) \<longrightarrow> (\<exists>node. ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node) \<and> mdbNext_update (\<lambda>_. dest) node = node'); p \<noteq> src; mdbNext (cteMDBNode z) \<noteq> dest; ctes_of s p = Some z; p \<noteq> dest\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<And>p capa node cap' node' z. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node. ctes_of s p = Some (CTE cap node) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> p' = mdbNext node \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs capa cap'; word1 \<noteq> mdbNext (cteMDBNode z); word1 \<noteq> p \<longrightarrow> z = CTE capa node; word1 = p \<longrightarrow> (\<exists>nodea. z = CTE capa nodea \<and> mdbPrev_update (\<lambda>_. dest) nodea = node); src \<noteq> mdbNext (cteMDBNode z) \<longrightarrow> ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node'); src = mdbNext (cteMDBNode z) \<longrightarrow> (\<exists>node. ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node) \<and> mdbNext_update (\<lambda>_. dest) node = node'); p \<noteq> src; mdbNext (cteMDBNode z) \<noteq> dest; ctes_of s p = Some z; p \<noteq> dest\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<And>p capa node cap' node' z x1 x2. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node. ctes_of s p = Some (CTE cap node) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> p' = mdbNext node \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs capa cap'; word1 \<noteq> mdbNext (cteMDBNode z); word1 \<noteq> p \<longrightarrow> z = CTE capa node; word1 = p \<longrightarrow> (\<exists>nodea. z = CTE capa nodea \<and> mdbPrev_update (\<lambda>_. dest) nodea = node); src \<noteq> mdbNext (cteMDBNode z) \<longrightarrow> ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node'); src = mdbNext (cteMDBNode z) \<longrightarrow> (\<exists>node. ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node) \<and> mdbNext_update (\<lambda>_. dest) node = node'); p \<noteq> src; mdbNext (cteMDBNode z) \<noteq> dest; ctes_of s p = Some z; p \<noteq> dest; z = CTE x1 x2\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<And>p capa node cap' node' z capability mdbnode. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node. ctes_of s p = Some (CTE cap node) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> p' = mdbNext node \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs capa cap'; word1 \<noteq> mdbNext (cteMDBNode z); word1 \<noteq> p \<longrightarrow> z = CTE capa node; word1 = p \<longrightarrow> (\<exists>nodea. z = CTE capa nodea \<and> mdbPrev_update (\<lambda>_. dest) nodea = node); src \<noteq> mdbNext (cteMDBNode z) \<longrightarrow> ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node'); src = mdbNext (cteMDBNode z) \<longrightarrow> (\<exists>node. ctes_of s (mdbNext (cteMDBNode z)) = Some (CTE cap' node) \<and> mdbNext_update (\<lambda>_. dest) node = node'); p \<noteq> src; mdbNext (cteMDBNode z) \<noteq> dest; ctes_of s p = Some z; p \<noteq> dest; z = CTE capability mdbnode\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<And>p capa node cap' node' capability mdbnode. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); \<forall>p p' cap node. ctes_of s p = Some (CTE cap node) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> p' = mdbNext node \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs capa cap'; word1 \<noteq> mdbNext mdbnode; word1 \<noteq> p \<longrightarrow> capability = capa \<and> mdbnode = node; word1 = p \<longrightarrow> capability = capa \<and> mdbPrev_update (\<lambda>_. dest) mdbnode = node; src \<noteq> mdbNext mdbnode \<longrightarrow> ctes_of s (mdbNext mdbnode) = Some (CTE cap' node'); src = mdbNext mdbnode \<longrightarrow> (\<exists>node. ctes_of s (mdbNext mdbnode) = Some (CTE cap' node) \<and> mdbNext_update (\<lambda>_. dest) node = node'); p \<noteq> src; mdbNext mdbnode \<noteq> dest; ctes_of s p = Some (CTE capability mdbnode); p \<noteq> dest\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (prove)
goal (1 subgoal):
 1. \<And>p capa node cap' node' capability mdbnode. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); global.sameRegionAs capa cap'; word1 \<noteq> mdbNext mdbnode; word1 \<noteq> p \<longrightarrow> capability = capa \<and> mdbnode = node; word1 = p \<longrightarrow> capability = capa \<and> mdbPrev_update (\<lambda>_. dest) mdbnode = node; src \<noteq> mdbNext mdbnode \<longrightarrow> ctes_of s (mdbNext mdbnode) = Some (CTE cap' node'); src = mdbNext mdbnode \<longrightarrow> (\<exists>node. ctes_of s (mdbNext mdbnode) = Some (CTE cap' node) \<and> mdbNext_update (\<lambda>_. dest) node = node'); p \<noteq> src; mdbNext mdbnode \<noteq> dest; ctes_of s p = Some (CTE capability mdbnode); p \<noteq> dest; \<forall>cap node. ctes_of s p = Some (CTE cap node) \<longrightarrow> (\<forall>cap' node'. ctes_of s (mdbNext mdbnode) = Some (CTE cap' node') \<longrightarrow> mdbNext mdbnode = mdbNext node \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'))\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') proof (state)
this:
valid_badges (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))

goal (6 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
badge_derived' cap src_cap proof (prove)
using this:
badge_derived' cap src_cap

goal (1 subgoal):
 1. isUntypedCap cap = isUntypedCap src_cap proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> isUntypedCap cap = isUntypedCap src_cap proof (prove)
goal:
No subgoals! proof (state)
this:
isUntypedCap cap = isUntypedCap src_cap

goal (6 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
badge_derived' cap src_cap proof (prove)
using this:
badge_derived' cap src_cap

goal (1 subgoal):
 1. capRange cap = capRange src_cap proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap proof (prove)
goal (12 subgoals):
 1. \<And>x1. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 2. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.NullCap\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 3. \<And>x31 x32 x33 x34. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 4. \<And>x4. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 5. \<And>x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 6. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 7. \<And>x71 x72 x73. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 8. \<And>x8. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 9. \<And>x91 x92 x93. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 10. \<And>x101 x102 x103 x104. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
A total of 12 subgoals... proof (prove)
goal (5 subgoals):
 1. \<And>x8. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap x8); capBadge src_cap = None; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (acapClass x8 \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass x8 = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr x8 \<le> Arch.capUntypedPtr x8 + 2 ^ acapBits x8 - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr x8 = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr x8 + 2 ^ acapBits x8 = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr x8 \<le> Arch.capUntypedPtr x8 + 2 ^ acapBits x8 - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 2. \<And>x91 x92 x93. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 3. \<And>x101 x102 x103 x104. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 4. \<And>x111 x112 x113 x114. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 5. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap proof (prove)
goal (5 subgoals):
 1. \<And>x8. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap x8); capBadge src_cap = None; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (acapClass x8 \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass x8 = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr x8 \<le> Arch.capUntypedPtr x8 + 2 ^ acapBits x8 - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr x8 = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr x8 + 2 ^ acapBits x8 = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr x8 \<le> Arch.capUntypedPtr x8 + 2 ^ acapBits x8 - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 2. \<And>x91 x92 x93. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 3. \<And>x101 x102 x103 x104. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 4. \<And>x111 x112 x113 x114. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 5. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap proof (prove)
goal (5 subgoals):
 1. \<And>arch_capability. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 2. \<And>x91 x92 x93. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 3. \<And>x101 x102 x103 x104. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 4. \<And>x111 x112 x113 x114. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 5. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap proof (prove)
goal (9 subgoals):
 1. \<And>arch_capability x11 x12. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 2. \<And>arch_capability. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 3. \<And>arch_capability x31 x32 x33 x34 x35. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 4. \<And>arch_capability x41 x42. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 5. \<And>arch_capability x51 x52. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 6. \<And>x91 x92 x93. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 7. \<And>x101 x102 x103 x104. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 8. \<And>x111 x112 x113 x114. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 9. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap proof (prove)
goal (9 subgoals):
 1. \<And>arch_capability x11 x12. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 2. \<And>arch_capability. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 3. \<And>arch_capability x31 x32 x33 x34 x35. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 4. \<And>arch_capability x41 x42. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 5. \<And>arch_capability x51 x52. \<lbrakk>capMasterCap src_cap = capMasterCap (capability.ArchObjectCap arch_capability); capBadge src_cap = None; cap = capability.ArchObjectCap arch_capability; arch_capability = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (acapClass arch_capability \<noteq> PhysicalClass \<longrightarrow> capClass src_cap = PhysicalClass \<longrightarrow> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1) \<and> (acapClass arch_capability = PhysicalClass \<longrightarrow> (capClass src_cap \<noteq> PhysicalClass \<longrightarrow> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1) \<and> (capClass src_cap = PhysicalClass \<longrightarrow> Arch.capUntypedPtr arch_capability = global.capUntypedPtr src_cap \<and> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability = global.capUntypedPtr src_cap + 2 ^ capBits src_cap \<or> \<not> Arch.capUntypedPtr arch_capability \<le> Arch.capUntypedPtr arch_capability + 2 ^ acapBits arch_capability - 1 \<and> \<not> global.capUntypedPtr src_cap \<le> global.capUntypedPtr src_cap + 2 ^ capBits src_cap - 1))
 6. \<And>x91 x92 x93. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 7. \<And>x101 x102 x103 x104. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 8. \<And>x111 x112 x113 x114. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap
 9. \<lbrakk>capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> capRange cap = capRange src_cap proof (prove)
goal:
No subgoals! proof (state)
this:
capRange cap = capRange src_cap

goal (6 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. untypedRange cap = untypedRange src_cap proof (prove)
using this:
badge_derived' cap src_cap

goal (1 subgoal):
 1. untypedRange cap = untypedRange src_cap proof (prove)
goal:
No subgoals! proof (state)
this:
untypedRange cap = untypedRange src_cap

goal (6 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 6. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
caps_contained' (ctes_of s)
badge_derived' cap src_cap
src \<noteq> dest
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
is_derived' (ctes_of s) src cap src_cap
ctes_of s 0 = None proof (prove)
using this:
caps_contained' (ctes_of s)
badge_derived' cap src_cap
src \<noteq> dest
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
is_derived' (ctes_of s) src cap src_cap
ctes_of s 0 = None

goal (1 subgoal):
 1. caps_contained' (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' = dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange src_cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest; p' = src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange src_cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange src_cap; capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = dest; p' \<noteq> dest; p' \<noteq> src; \<exists>cteb. ctes_of s p' = Some cteb \<and> cteCap (CTE c' n') = cteCap cteb\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p' x cteb. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap (cteCap cteb); capRange (cteCap cteb) \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange (cteCap cteb); p' \<noteq> dest; p' \<noteq> src; ctes_of s p' = Some cteb\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p' x cteb. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap (cteCap cteb); capRange (cteCap cteb) \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange (cteCap cteb); p' \<noteq> dest; p' \<noteq> src; ctes_of s p' = Some cteb; isUntypedCap src_cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p' x cteb. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap (cteCap cteb); capRange (cteCap cteb) \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange (cteCap cteb); p' \<noteq> dest; p' \<noteq> src; ctes_of s p' = Some cteb; isUntypedCap src_cap; \<forall>c'. (\<exists>n'. cteb = CTE c' n') \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange src_cap \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange src_cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p' x cteb x1 x2. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap (cteCap cteb); capRange (cteCap cteb) \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange (cteCap cteb); p' \<noteq> dest; p' \<noteq> src; ctes_of s p' = Some cteb; isUntypedCap src_cap; \<forall>c'. (\<exists>n'. cteb = CTE c' n') \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange src_cap \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange src_cap; cteb = CTE x1 x2\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p' x x1 x2. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap x1; capRange x1 \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange x1; p' \<noteq> dest; p' \<noteq> src; ctes_of s p' = Some (CTE x1 x2); isUntypedCap src_cap; capRange x1 \<subseteq> untypedRange src_cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' = dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' = dest; p = src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' = dest; p \<noteq> src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange src_cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' = dest; p \<noteq> src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap cap; x \<in> capRange src_cap; isUntypedCap src_cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' = dest; p \<noteq> src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; \<not> isUntypedCap cap; x_ \<in> capRange src_cap; isUntypedCap src_cap\<rbrakk> \<Longrightarrow> x_ \<in> untypedRange src_cap proof (prove)
goal (2 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' = dest; p \<noteq> src\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>c n x z. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c n\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>c n x z. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c n; \<forall>p' c. (\<exists>n. ctes_of s word1 = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>c n x z. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c n; \<forall>c. (\<exists>n. ctes_of s word1 = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s src = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>c n x z x1 x2. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c n; \<forall>c. (\<exists>n. ctes_of s word1 = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s src = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); z = CTE x1 x2\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (3 subgoals):
 1. \<And>c x x2. \<lbrakk>\<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; ctes_of s word1 = Some (CTE c x2); capRange src_cap \<subseteq> untypedRange c\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n); \<forall>p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n); \<forall>c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s src = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c n x. \<lbrakk>\<not> isUntypedCap cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n); \<forall>c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s src = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); isUntypedCap c\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (2 subgoals):
 1. \<And>p c n x. \<lbrakk>\<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; p \<noteq> src; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; ctes_of s p = Some (CTE c n); capRange src_cap \<subseteq> untypedRange c; isUntypedCap c\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n' x. \<lbrakk>\<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n' x. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest; \<forall>p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c' n' x. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE c n); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest; \<forall>c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (9 subgoals):
 1. \<And>n c' x z. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c' \<noteq> {}; x \<in> capRange c'; \<forall>c. (\<exists>n. z = CTE c n) \<longrightarrow> (\<forall>c'. (\<exists>n'. z = CTE c' n') \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c' n\<rbrakk> \<Longrightarrow> x \<in> untypedRange c'
 2. \<And>c n x z. \<lbrakk>\<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; \<forall>c. (\<exists>n. z = CTE c n) \<longrightarrow> capRange src_cap \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange src_cap \<subseteq> untypedRange c; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c n\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p' c n c' n' x z. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p' \<noteq> dest; \<forall>c. (\<exists>n. z = CTE c n) \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p' \<noteq> word1; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c n; p' \<noteq> src; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 4. \<And>c' n' x z. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange c'; \<forall>c'. (\<exists>n'. z = CTE c' n') \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange src_cap \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c' n'\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 5. \<And>p c n c' n' x z. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; \<forall>c'. (\<exists>n'. z = CTE c' n') \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; p \<noteq> src; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE c' n'; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 6. \<And>x. \<lbrakk>\<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange src_cap; capRange src_cap \<subseteq> untypedRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 7. \<And>p' c' n' x. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange c'; p' \<noteq> dest; capRange c' \<subseteq> untypedRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p' \<noteq> word1; p' \<noteq> src; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 8. \<And>p c n x. \<lbrakk>\<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; capRange src_cap \<subseteq> untypedRange c; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; p \<noteq> src; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 9. \<And>p p' c n c' n' x. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest; capRange c' \<subseteq> untypedRange c; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; p \<noteq> src; ctes_of s p = Some (CTE c n); p' \<noteq> word1; p' \<noteq> src; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>\<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange src_cap; capRange src_cap \<subseteq> untypedRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 2. \<And>p' c' n' x. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange src_cap \<noteq> {}; x \<in> capRange c'; p' \<noteq> dest; capRange c' \<subseteq> untypedRange src_cap; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p' \<noteq> word1; p' \<noteq> src; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange src_cap
 3. \<And>p c n x. \<lbrakk>\<not> isUntypedCap src_cap; capRange src_cap \<inter> untypedRange c \<noteq> {}; x \<in> capRange src_cap; p \<noteq> dest; capRange src_cap \<subseteq> untypedRange c; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; p \<noteq> src; ctes_of s p = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 4. \<And>p p' c n c' n' x. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<noteq> dest; p' \<noteq> dest; capRange c' \<subseteq> untypedRange c; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); is_derived' (ctes_of s) src cap src_cap; ctes_of s 0 = None; p \<noteq> word1; p \<noteq> src; ctes_of s p = Some (CTE c n); p' \<noteq> word1; p' \<noteq> src; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c proof (state)
this:
caps_contained' (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))

goal (5 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 5. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
using this:
is_derived' (ctes_of s) src cap src_cap
valid_nullcaps (ctes_of s)
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
valid_dlist (ctes_of s)
ctes_of s 0 = None

goal (1 subgoal):
 1. valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_derived' (ctes_of s) src cap src_cap; \<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); ctes_of s 0 = None\<rbrakk> \<Longrightarrow> \<forall>p n. modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>\<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; badge_derived' cap src_cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); p \<noteq> dest\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> src_cap = capability.NullCap \<longrightarrow> MDB dest word2 bool1a bool2a = nullMDBNode) \<and> (p \<noteq> src \<longrightarrow> p = word1 \<longrightarrow> (\<forall>n. (\<exists>z. ctes_of s word1 = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode)) proof (prove)
goal (2 subgoals):
 1. \<And>p. \<lbrakk>\<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; badge_derived' cap src_cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); p \<noteq> dest\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> src_cap = capability.NullCap \<longrightarrow> MDB dest word2 bool1a bool2a = nullMDBNode
 2. \<And>p. \<lbrakk>\<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; badge_derived' cap src_cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> p = word1 \<longrightarrow> (\<forall>n. (\<exists>z. ctes_of s word1 = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode) proof (prove)
goal (1 subgoal):
 1. \<And>n z. \<lbrakk>\<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE capability.NullCap n\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>n z. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE capability.NullCap n; \<forall>n. ctes_of s word1 = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<And>n z x1 x2. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE capability.NullCap n; \<forall>n. ctes_of s word1 = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; z = CTE x1 x2\<rbrakk> \<Longrightarrow> n = nullMDBNode proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some (CTE capability.NullCap (MDB nullPointer nullPointer False False))\<rbrakk> \<Longrightarrow> dest = nullPointer proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some (CTE capability.NullCap (MDB nullPointer nullPointer False False))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE src_cap (MDB word1 word2 bool1a bool2a))) \<noteq> 0
 2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some (CTE capability.NullCap (MDB nullPointer nullPointer False False)); \<exists>cte'. ctes_of s (mdbNext (cteMDBNode (CTE src_cap (MDB word1 word2 bool1a bool2a)))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> dest = nullPointer proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some (CTE capability.NullCap (MDB nullPointer nullPointer False False))\<rbrakk> \<Longrightarrow> word1 \<noteq> 0
 2. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some (CTE capability.NullCap (MDB nullPointer nullPointer False False)); \<exists>cte'. ctes_of s (mdbNext (cteMDBNode (CTE src_cap (MDB word1 word2 bool1a bool2a)))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> dest = nullPointer proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_dlist (ctes_of s); ctes_of s 0 = None; cap \<noteq> capability.NullCap; \<not> isZombie src_cap; \<not> isIRQControlCap cap; isUntypedCap src_cap \<longrightarrow> descendants_of' src (ctes_of s) = {}; isReplyCap src_cap = isReplyCap cap; isReplyCap cap \<longrightarrow> capReplyMaster src_cap; isReplyCap cap \<longrightarrow> \<not> capReplyMaster cap; vsCapRef src_cap = vsCapRef cap \<or> isArchCap isPageCap cap; isArchCap isPageTableCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); isArchCap isPageDirectoryCap src_cap \<longrightarrow> capASID src_cap = capASID cap \<and> (\<exists>y. capASID src_cap = Some y); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; ctes_of s word1 = Some (CTE capability.NullCap (MDB nullPointer nullPointer False False)); \<exists>cte'. ctes_of s (mdbNext (cteMDBNode (CTE src_cap (MDB word1 word2 bool1a bool2a)))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src\<rbrakk> \<Longrightarrow> dest = nullPointer proof (prove)
goal:
No subgoals! proof (state)
this:
valid_nullcaps (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))

goal (4 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> ut_revocable' (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 4. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
valid_mdb_ctes (ctes_of s)
src \<noteq> dest
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ut_revocable' (ctes_of s) proof (prove)
using this:
valid_mdb_ctes (ctes_of s)
src \<noteq> dest
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ut_revocable' (ctes_of s)

goal (1 subgoal):
 1. ut_revocable' (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> (p = dest \<longrightarrow> isUntypedCap cap \<longrightarrow> revokable' src_cap cap) \<and> (p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> isUntypedCap src_cap \<longrightarrow> bool1a) \<and> (p \<noteq> src \<longrightarrow> p = word1 \<longrightarrow> (\<forall>cap n. (\<exists>z. ctes_of s word1 = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n))) proof (prove)
goal (2 subgoals):
 1. \<And>p. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> p = dest \<longrightarrow> isUntypedCap cap \<longrightarrow> revokable' src_cap cap
 2. \<And>p. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> isUntypedCap src_cap \<longrightarrow> bool1a) \<and> (p \<noteq> src \<longrightarrow> p = word1 \<longrightarrow> (\<forall>cap n. (\<exists>z. ctes_of s word1 = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n)) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap\<rbrakk> \<Longrightarrow> revokable' src_cap cap
 2. \<And>p. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> isUntypedCap src_cap \<longrightarrow> bool1a) \<and> (p \<noteq> src \<longrightarrow> p = word1 \<longrightarrow> (\<forall>cap n. (\<exists>z. ctes_of s word1 = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE cap n) \<longrightarrow> isUntypedCap cap \<longrightarrow> mdbRevocable n)) proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> (\<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> dest\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> (\<exists>d v0 v1 f. src_cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> bool1a) \<and> (p \<noteq> src \<longrightarrow> p = word1 \<longrightarrow> (\<forall>cap n. (\<exists>z. ctes_of s word1 = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE cap n) \<longrightarrow> (\<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> mdbRevocable n)) proof (prove)
goal (2 subgoals):
 1. \<And>d v0 v1 f. \<lbrakk>ctes_of s src = Some (CTE (capability.UntypedCap d v0 v1 f) (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> (\<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); src_cap = capability.UntypedCap d v0 v1 f\<rbrakk> \<Longrightarrow> bool1a
 2. \<And>n z d v0 v1 f. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> (\<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE (capability.UntypedCap d v0 v1 f) n\<rbrakk> \<Longrightarrow> mdbRevocable n proof (prove)
goal (2 subgoals):
 1. \<And>d v0 v1 f. \<lbrakk>ctes_of s src = Some (CTE (capability.UntypedCap d v0 v1 f) (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); src_cap = capability.UntypedCap d v0 v1 f; \<forall>cap n. ctes_of s src = Some (CTE cap n) \<longrightarrow> (\<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> mdbRevocable n\<rbrakk> \<Longrightarrow> bool1a
 2. \<And>n z d v0 v1 f. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> (\<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE (capability.UntypedCap d v0 v1 f) n\<rbrakk> \<Longrightarrow> mdbRevocable n proof (prove)
goal (1 subgoal):
 1. \<And>n z d v0 v1 f. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> (\<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE (capability.UntypedCap d v0 v1 f) n\<rbrakk> \<Longrightarrow> mdbRevocable n proof (prove)
goal (1 subgoal):
 1. \<And>n z d v0 v1 f x1 x2. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); \<forall>p cap n. ctes_of s p = Some (CTE cap n) \<longrightarrow> (\<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f) \<longrightarrow> mdbRevocable n; class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s word1 = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE (capability.UntypedCap d v0 v1 f) n; z = CTE x1 x2\<rbrakk> \<Longrightarrow> mdbRevocable n proof (prove)
goal:
No subgoals! proof (state)
this:
ut_revocable' (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))

goal (3 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> class_links (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 3. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
class_links (ctes_of s)
src \<noteq> dest
badge_derived' cap src_cap
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
ctes_of s 0 = None
valid_dlist (ctes_of s) proof (prove)
using this:
class_links (ctes_of s)
src \<noteq> dest
badge_derived' cap src_cap
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
ctes_of s 0 = None
valid_dlist (ctes_of s)

goal (1 subgoal):
 1. class_links (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
using this:
\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
src \<noteq> dest
badge_derived' cap src_cap
ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a))
ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2))
ctes_of s 0 = None
valid_dlist (ctes_of s)

goal (1 subgoal):
 1. \<forall>p p' cte cte'. modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte \<longrightarrow> modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte' \<longrightarrow> modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) \<turnstile> p \<leadsto> p'\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0) \<or> p = src \<and> p' = dest \<or> p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (3 subgoals):
 1. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; ctes_of s \<turnstile> p \<leadsto> p' \<and> p \<noteq> src \<and> p' \<noteq> dest \<and> (p' = word1 \<longrightarrow> p' = 0)\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 2. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; p = src \<and> p' = dest\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 3. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (2 subgoals):
 1. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; p = src \<and> p' = dest\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 2. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>p p' cte. ctes_of s p = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> capClass src_cap = capClass cap
 2. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cte cte'. \<lbrakk>\<forall>p p' cte cte'. ctes_of s p = Some cte \<longrightarrow> ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'); src \<noteq> dest; badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p' = Some cte'; p = dest \<and> p' = word1\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte') proof (prove)
goal (1 subgoal):
 1. \<And>z. \<lbrakk>\<forall>p p' cte. ctes_of s p = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); ctes_of s word1 = Some z\<rbrakk> \<Longrightarrow> capClass cap = capClass (cteCap z) proof (prove)
goal (1 subgoal):
 1. \<And>z. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); ctes_of s word1 = Some z; \<forall>p' cte. ctes_of s src = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> src \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'))\<rbrakk> \<Longrightarrow> capClass cap = capClass (cteCap z) proof (prove)
goal (1 subgoal):
 1. \<And>z. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); ctes_of s word1 = Some z; \<forall>cte. ctes_of s src = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s word1 = Some cte' \<longrightarrow> ctes_of s \<turnstile> src \<leadsto> word1 \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte'))\<rbrakk> \<Longrightarrow> capClass cap = capClass (cteCap z) proof (prove)
goal (1 subgoal):
 1. \<And>z. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); ctes_of s word1 = Some z; capClass src_cap = capClass (cteCap z)\<rbrakk> \<Longrightarrow> capClass cap = capClass (cteCap z) proof (prove)
goal (1 subgoal):
 1. \<And>z x1 x2. \<lbrakk>badge_derived' cap src_cap; ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); ctes_of s word1 = Some z; capClass src_cap = capClass (cteCap z); z = CTE x1 x2\<rbrakk> \<Longrightarrow> capClass cap = capClass (cteCap z) proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); ctes_of s word1 = Some (CTE x1 x2); capClass src_cap = capClass x1; capMasterCap src_cap = capMasterCap cap; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False\<rbrakk> \<Longrightarrow> capClass cap = capClass x1 proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>ctes_of s src = Some (CTE src_cap (MDB word1 word2 bool1a bool2a)); ctes_of s dest = Some (CTE capability.NullCap (MDB 0 0 bool1 bool2)); ctes_of s 0 = None; valid_dlist (ctes_of s); ctes_of s word1 = Some (CTE x1 x2); capClass src_cap = capClass x1; (capBadge src_cap, capBadge cap) \<in> capBadge_ordering False; capClass src_cap = capClass cap\<rbrakk> \<Longrightarrow> capClass cap = capClass x1 proof (prove)
goal:
No subgoals! proof (state)
this:
class_links (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> distinct_zombies (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))
 2. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
distinct_zombies (ctes_of s)
badge_derived' cap src_cap proof (prove)
using this:
distinct_zombies (ctes_of s)
badge_derived' cap src_cap

goal (1 subgoal):
 1. distinct_zombies (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>distinct_zombies (ctes_of s); badge_derived' cap src_cap\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) proof (prove)
goal (3 subgoals):
 1. badge_derived' cap src_cap \<Longrightarrow> ctes_of s src = Some ?cte2
 2. \<lbrakk>badge_derived' cap src_cap; capClass (cteCap (CTE cap (MDB 0 0 bool1 bool2))) = PhysicalClass\<rbrakk> \<Longrightarrow> capMasterCap (cteCap ?cte2) = capMasterCap (cteCap (CTE cap (MDB 0 0 bool1 bool2)))
 3. \<lbrakk>badge_derived' cap src_cap; isZombie (cteCap (CTE cap (MDB 0 0 bool1 bool2)))\<rbrakk> \<Longrightarrow> src = dest proof (prove)
goal (2 subgoals):
 1. \<lbrakk>badge_derived' cap src_cap; capClass (cteCap (CTE cap (MDB 0 0 bool1 bool2))) = PhysicalClass\<rbrakk> \<Longrightarrow> capMasterCap (cteCap (CTE src_cap (MDB word1 word2 bool1a bool2a))) = capMasterCap (cteCap (CTE cap (MDB 0 0 bool1 bool2)))
 2. \<lbrakk>badge_derived' cap src_cap; isZombie (cteCap (CTE cap (MDB 0 0 bool1 bool2)))\<rbrakk> \<Longrightarrow> src = dest proof (prove)
goal (1 subgoal):
 1. \<lbrakk>badge_derived' cap src_cap; isZombie (cteCap (CTE cap (MDB 0 0 bool1 bool2)))\<rbrakk> \<Longrightarrow> src = dest proof (prove)
goal:
No subgoals! proof (state)
this:
distinct_zombies (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))

goal (1 subgoal):
 1. \<And>sa cap1 x1 x2 x3 x4 x3a x4a. \<lbrakk>valid_dlist (ctes_of sa); ctes_of sa 0 = None; mdb_chain_0 (ctes_of sa); valid_badges (ctes_of sa); caps_contained' (ctes_of sa); mdb_chunked (ctes_of sa); untyped_mdb' (ctes_of sa); untyped_inc' (ctes_of sa); valid_nullcaps (ctes_of sa); ut_revocable' (ctes_of sa); class_links (ctes_of sa); distinct_zombies (ctes_of sa); irq_control (ctes_of sa); reply_masters_rvk_fb (ctes_of sa); pspace_aligned' sa; pspace_distinct' sa; src \<noteq> dest; capAligned cap; valid_objs' sa; ctes_of sa src = Some (CTE cap1 (MDB x1 x2 x3 x4)); is_derived' (ctes_of sa) src cap cap1; ctes_of sa dest = Some (CTE capability.NullCap (MDB 0 0 x3a x4a)); dest \<noteq> 0\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of sa)(dest \<mapsto> CTE cap (MDB 0 0 x3a x4a))) dest (cteMDBNode_update (\<lambda>a. MDB x1 src (revokable' cap1 cap) (revokable' cap1 cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) x1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (chain)
picking this:
reply_masters_rvk_fb (ctes_of s)
is_derived' (ctes_of s) src cap src_cap proof (prove)
using this:
reply_masters_rvk_fb (ctes_of s)
is_derived' (ctes_of s) src cap src_cap

goal (1 subgoal):
 1. reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; cte \<in> ran (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))); isReplyCap (cteCap cte); capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (1 subgoal):
 1. \<And>cte x. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) x = Some cte\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (4 subgoals):
 1. \<And>z. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; isReplyCap (cteCap z); capReplyMaster (cteCap z); ctes_of s word1 = Some z\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode z) \<and> mdbFirstBadged (cteMDBNode z)
 2. \<And>z. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; isReplyCap (cteCap z); capReplyMaster (cteCap z); ctes_of s src = Some z\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode z) \<and> mdbFirstBadged (cteMDBNode z)
 3. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; isReplyCap cap; capReplyMaster cap\<rbrakk> \<Longrightarrow> revokable' src_cap cap
 4. \<And>cte x. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); x \<noteq> word1; x \<noteq> src; x \<noteq> dest; ctes_of s x = Some cte\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; isReplyCap cap; capReplyMaster cap\<rbrakk> \<Longrightarrow> revokable' src_cap cap
 2. \<And>cte x. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); x \<noteq> word1; x \<noteq> src; x \<noteq> dest; ctes_of s x = Some cte\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (1 subgoal):
 1. \<And>cte x. \<lbrakk>\<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); is_derived' (ctes_of s) src cap src_cap; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); x \<noteq> word1; x \<noteq> src; x \<noteq> dest; ctes_of s x = Some cte\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal:
No subgoals! proof (state)
this:
reply_masters_rvk_fb (modify_map (modify_map (modify_map ((ctes_of s)(dest \<mapsto> CTE cap (MDB 0 0 bool1 bool2))) dest (cteMDBNode_update (\<lambda>a. MDB word1 src (revokable' src_cap cap) (revokable' src_cap cap)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) word1 (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))

goal:
No subgoals!