theory CSpace_I

lemma untyped_inc_init:
  "\<lbrakk> valid_mdb_ctes m; m p = Some cte; no_mdb cte;
     caps_no_overlap' m (capRange cap);
     valid_objs' s; s \<turnstile>' cap;
     m = ctes_of s\<rbrakk>
    \<Longrightarrow> untyped_inc' (m(p \<mapsto> CTE cap initMDBNode))" apply (clarsimp simp add: valid_mdb_ctes_def untyped_inc'_def) apply (intro conjI impI) apply clarsimp apply (simp add: caps_no_overlap'_def) apply (erule_tac x=p' in allE, erule allE, erule impE, erule exI) apply (drule (1) ctes_of_valid_cap')+ apply (drule valid_capAligned)+ apply (frule usableRange_subseteq[OF _ untypedRange_not_emptyD]) apply (drule (1) aligned_untypedRange_non_empty) apply assumption apply (frule_tac c' = c' in  usableRange_subseteq) apply (drule (1) aligned_untypedRange_non_empty) apply assumption apply (drule(1) aligned_untypedRange_non_empty)+ apply (thin_tac "All P" for P) apply (subgoal_tac "untypedRange cap \<inter> untypedRange c' = {}") apply (intro conjI) apply simp apply (drule(2) set_inter_not_emptyD2) apply fastforce apply (drule(2) set_inter_not_emptyD1) apply fastforce apply (drule(2) set_inter_not_emptyD3) apply simp+ apply (rule disjoint_subset2[OF _ disjoint_subset]) apply (rule untypedRange_in_capRange)+ apply (simp add:Int_ac) apply clarsimp apply (cases cte) apply (rename_tac capability mdbnode) apply clarsimp apply (subgoal_tac "mdb_ptr (ctes_of s) p capability mdbnode") prefer 2 apply (simp add: vmdb_def mdb_ptr_def mdb_ptr_axioms_def valid_mdb_ctes_def untyped_inc'_def) apply (clarsimp simp: mdb_ptr.descendants_of_init') apply (simp add: caps_no_overlap'_def) apply (erule_tac x=pa in allE, erule allE, erule impE, erule exI) apply (drule (1) ctes_of_valid_cap')+ apply (drule valid_capAligned)+ apply (frule usableRange_subseteq[OF _ untypedRange_not_emptyD]) apply (drule (1) aligned_untypedRange_non_empty) apply assumption apply (frule_tac c' = c in  usableRange_subseteq) apply (drule (1) aligned_untypedRange_non_empty) apply assumption apply (drule (1) aligned_untypedRange_non_empty)+ apply (drule untypedCapRange)+ apply (thin_tac "All P" for P) apply (subgoal_tac "untypedRange cap \<inter> untypedRange c = {}") apply (intro conjI) apply simp apply (drule(2) set_inter_not_emptyD1) apply fastforce apply (drule(2) set_inter_not_emptyD2) apply fastforce apply (drule(2) set_inter_not_emptyD3) apply simp+ apply (rule disjoint_subset2[OF _ disjoint_subset]) apply (rule untypedRange_in_capRange)+ apply (simp add:Int_ac) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_mdb_ctes m; m p = Some cte; no_mdb cte; caps_no_overlap' m (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s\<rbrakk> \<Longrightarrow> untyped_inc' (m(p \<mapsto> CTE cap initMDBNode)) proof (prove)
goal (1 subgoal):
 1. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> (pa = p \<longrightarrow> isUntypedCap cap \<longrightarrow> (\<forall>p'. p' \<noteq> p \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})))) \<and> (pa \<noteq> p \<longrightarrow> (\<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))))) proof (prove)
goal (2 subgoals):
 1. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa = p; isUntypedCap cap\<rbrakk> \<Longrightarrow> \<forall>p'. p' \<noteq> p \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {}))
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; ctes_of s p' = Some (CTE c' n'); isUntypedCap c'\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; \<forall>p c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> capRange c \<inter> capRange cap = {}; valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; ctes_of s p' = Some (CTE c' n'); isUntypedCap c'\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; ctes_of s p' = Some (CTE c' n'); isUntypedCap c'; capRange c' \<inter> capRange cap = {}\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; valid_cap' c' s\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'\<rbrakk> \<Longrightarrow> untypedRange cap \<noteq> {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'; usableUntypedRange cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 3. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned c'; untypedRange cap \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<noteq> {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'; usableUntypedRange cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 3. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'; usableUntypedRange cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'; usableUntypedRange cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> isUntypedCap c'
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 3. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned c'; usableUntypedRange cap \<subseteq> untypedRange cap; untypedRange cap \<noteq> {}\<rbrakk> \<Longrightarrow> isUntypedCap c'
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 3. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; capAligned cap; capAligned c'; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> (untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}) \<and> (untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {})
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 3. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange cap \<or> untypedRange cap \<inter> untypedRange c' = {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}
 3. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}
 4. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {}
 5. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 6. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}
 3. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {}
 4. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 5. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; \<not> untypedRange cap \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> untypedRange cap \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c' = {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}
 3. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {}
 4. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 5. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {}
 3. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 4. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; \<not> untypedRange c' \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange c' \<subset> untypedRange cap \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {}
 3. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 4. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 3. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}; untypedRange cap \<noteq> untypedRange c'\<rbrakk> \<Longrightarrow> untypedRange cap = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {}
 2. \<And>p' c' n'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 3. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c' = {}
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange c' \<subseteq> ?B322 p' c'
 2. \<And>p' c'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<subseteq> ?A323 p' c'
 3. \<And>p' c'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> ?A323 p' c' \<inter> ?B322 p' c' = {}
 4. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; isUntypedCap c'; capRange c' \<inter> capRange cap = {}; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c' \<subseteq> untypedRange c'; untypedRange cap \<noteq> {}; untypedRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> capRange cap \<inter> capRange c' = {}
 2. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (1 subgoal):
 1. \<And>pa. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> \<forall>p'. (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (1 subgoal):
 1. \<And>pa p'. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p\<rbrakk> \<Longrightarrow> (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (1 subgoal):
 1. \<And>pa p' x1 x2. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (1 subgoal):
 1. \<And>pa p' capability mdbnode. \<lbrakk>ctes_of s p = Some cte; no_mdb cte; caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode\<rbrakk> \<Longrightarrow> (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (1 subgoal):
 1. \<And>pa p' capability mdbnode. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode\<rbrakk> \<Longrightarrow> (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (2 subgoals):
 1. \<And>pa p' capability mdbnode. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode\<rbrakk> \<Longrightarrow> (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p'))))
 2. \<And>pa p' capability mdbnode. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of s) p capability mdbnode proof (prove)
goal (2 subgoals):
 1. \<And>pa p' capability mdbnode. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of s) p capability mdbnode
 2. \<And>pa p' capability mdbnode. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode\<rbrakk> \<Longrightarrow> (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (1 subgoal):
 1. \<And>pa p' capability mdbnode. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode\<rbrakk> \<Longrightarrow> (p' = p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> isUntypedCap cap \<longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange cap = {}))) \<and> (p' \<noteq> p \<longrightarrow> (\<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode))) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' ((ctes_of s)(p \<mapsto> CTE cap initMDBNode)) \<and> usableUntypedRange c' = {} \<or> pa = p')))) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); caps_no_overlap' (ctes_of s) (capRange cap); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; ctes_of s pa = Some (CTE c n); isUntypedCap c; isUntypedCap cap\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); \<forall>p c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> capRange c \<inter> capRange cap = {}; valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; ctes_of s pa = Some (CTE c n); isUntypedCap c; isUntypedCap cap\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>ctes_of s p = Some (CTE capability mdbnode); no_mdb (CTE capability mdbnode); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; ctes_of s pa = Some (CTE c n); isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; valid_cap' cap s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; valid_cap' capability s; valid_cap' c s\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (2 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c\<rbrakk> \<Longrightarrow> untypedRange cap \<noteq> {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c; usableUntypedRange cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (2 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned capability; capAligned c; untypedRange cap \<noteq> {}\<rbrakk> \<Longrightarrow> untypedRange cap \<noteq> {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c; usableUntypedRange cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c; usableUntypedRange cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (2 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c; usableUntypedRange cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> isUntypedCap c
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (2 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned capability; capAligned c; usableUntypedRange cap \<subseteq> untypedRange cap; untypedRange cap \<noteq> {}\<rbrakk> \<Longrightarrow> isUntypedCap c
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned cap; capAligned capability; capAligned c; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; isUntypedCap c; isUntypedCap cap; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}) proof (prove)
goal (2 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}) \<and> (untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {})
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (5 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange cap = {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}
 3. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}
 4. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}
 5. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (4 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}
 3. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}
 4. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (4 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; \<not> untypedRange c \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange c \<subset> untypedRange cap \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}
 3. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}
 4. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (3 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}
 3. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (3 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; \<not> untypedRange cap \<subseteq> untypedRange c\<rbrakk> \<Longrightarrow> untypedRange cap \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange cap \<inter> usableUntypedRange c = {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}
 3. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (2 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (2 subgoals):
 1. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap; untypedRange cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange cap \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {}
 2. \<And>pa capability mdbnode c n. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; capRange c \<inter> capRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; untypedRange c \<inter> untypedRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<inter> untypedRange c = {} proof (prove)
goal (3 subgoals):
 1. \<And>pa capability mdbnode c. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; untypedRange c \<inter> untypedRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange c \<subseteq> ?B571 pa capability mdbnode c
 2. \<And>pa capability mdbnode c. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; untypedRange c \<inter> untypedRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> untypedRange cap \<subseteq> ?A572 pa capability mdbnode c
 3. \<And>pa capability mdbnode c. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; untypedRange c \<inter> untypedRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> ?A572 pa capability mdbnode c \<inter> ?B571 pa capability mdbnode c = {} proof (prove)
goal (1 subgoal):
 1. \<And>pa capability mdbnode c. \<lbrakk>no_mdb (CTE capability mdbnode); valid_objs' s; m = ctes_of s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; cte = CTE capability mdbnode; mdb_ptr (ctes_of s) p capability mdbnode; untypedRange c \<inter> untypedRange cap = {}; capAligned capability; usableUntypedRange cap \<subseteq> untypedRange cap; usableUntypedRange c \<subseteq> untypedRange c; untypedRange cap \<noteq> {}; untypedRange c \<noteq> {}; capRange c = untypedRange c; capRange cap = untypedRange cap\<rbrakk> \<Longrightarrow> capRange cap \<inter> capRange c = {} proof (prove)
goal:
No subgoals!