theory CSpace_R

lemma dlist':
  "valid_dlist m'" using src dest prev neq nxt dlist no_0 apply (simp add: m'_def n no_0_def) apply (simp add: valid_dlist_def Let_def) apply clarsimp apply (case_tac cte) apply (rename_tac cap node) apply (rule conjI) apply (clarsimp simp: modify_map_def nullPointer_def split: if_split_asm) apply (case_tac z) apply fastforce apply (case_tac z) apply (rename_tac capability mdbnode) apply clarsimp apply (rule conjI) apply fastforce apply clarsimp apply (rule conjI, fastforce) apply clarsimp apply (rule conjI) apply clarsimp apply (subgoal_tac "mdbNext mdbnode = mdbPrev src_node") prefer 2 apply fastforce apply (subgoal_tac "mdbNext mdbnode = src") prefer 2 apply fastforce apply fastforce apply clarsimp apply (rule conjI) apply clarsimp apply (frule_tac x=src in spec, erule allE, erule (1) impE) apply fastforce subgoal by fastforce subgoal by fastforce apply (rule conjI, clarsimp) apply fastforce apply (clarsimp, rule conjI, fastforce) apply (clarsimp, rule conjI) apply clarsimp apply (frule_tac x=src in spec, erule allE, erule (1) impE) subgoal by fastforce subgoal by fastforce apply (clarsimp simp: modify_map_def nullPointer_def split: if_split_asm) apply (case_tac z) apply (clarsimp, rule conjI, fastforce) apply (clarsimp, rule conjI, fastforce) apply (clarsimp, rule conjI) apply clarsimp apply (frule_tac x=src in spec, erule allE, erule (1) impE) subgoal by fastforce apply (clarsimp, rule conjI) apply clarsimp apply (frule_tac x=src in spec, erule allE, erule (1) impE) subgoal by fastforce subgoal by fastforce apply (case_tac z) subgoal by fastforce subgoal by fastforce apply (rule conjI) apply clarsimp apply fastforce apply clarsimp apply (rule conjI, fastforce) apply (clarsimp, rule conjI) apply clarsimp apply (frule_tac x=src in spec, erule allE, erule (1) impE) subgoal by fastforce apply (clarsimp, rule conjI) apply clarsimp apply (frule_tac x=src in spec, erule allE, erule (1) impE) subgoal by fastforce subgoal by fastforce done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. valid_dlist m' proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE capability.NullCap old_dest_node)
mdbPrev old_dest_node = 0
src \<noteq> dest
mdbNext old_dest_node = 0
valid_dlist m
no_0 m

goal (1 subgoal):
 1. valid_dlist m' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; valid_dlist m; m 0 = None\<rbrakk> \<Longrightarrow> valid_dlist (modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None\<rbrakk> \<Longrightarrow> \<forall>p cte. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)) proof (prove)
goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)) proof (prove)
goal (1 subgoal):
 1. \<And>p cte x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)) proof (prove)
goal (1 subgoal):
 1. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)) proof (prove)
goal (2 subgoals):
 1. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)
 2. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE cap node; mdbPrev node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbPrev node = src \<longrightarrow> mdbNext src_node = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbNext src_node)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> mdbNext node = mdbNext src_node) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbNext src_node))))
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbNext node = mdbPrev src_node) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap node z x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE cap node; mdbPrev node \<noteq> dest; z = CTE x1 x2\<rbrakk> \<Longrightarrow> (mdbPrev node = src \<longrightarrow> mdbNext src_node = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbNext src_node)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> mdbNext node = mdbNext src_node) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbNext src_node))))
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbNext node = mdbPrev src_node) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbNext node = mdbPrev src_node) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)))))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap node z x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; z = CTE x1 x2\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbNext node = mdbPrev src_node) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)))))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap node z capability mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; z = CTE capability mdbnode\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbNext node = mdbPrev src_node) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)))))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode)\<rbrakk> \<Longrightarrow> (mdbPrev mdbnode = dest \<longrightarrow> dest = 0) \<and> (mdbPrev mdbnode \<noteq> dest \<longrightarrow> (mdbPrev mdbnode = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> src \<longrightarrow> (mdbPrev mdbnode = mdbPrev src_node \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)))))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode)\<rbrakk> \<Longrightarrow> mdbPrev mdbnode = dest \<longrightarrow> dest = 0
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode)\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> dest \<longrightarrow> (mdbPrev mdbnode = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> src \<longrightarrow> (mdbPrev mdbnode = mdbPrev src_node \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode)\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> dest \<longrightarrow> (mdbPrev mdbnode = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> src \<longrightarrow> (mdbPrev mdbnode = mdbPrev src_node \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbPrev mdbnode = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> src \<longrightarrow> (mdbPrev mdbnode = mdbPrev src_node \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> src \<longrightarrow> (mdbPrev mdbnode = mdbPrev src_node \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> (mdbPrev mdbnode = mdbPrev src_node \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode = mdbPrev src_node \<longrightarrow> mdbPrev src_node = 0
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev src_node = 0
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (6 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node; mdbNext mdbnode = mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev src_node = 0
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext mdbnode = mdbPrev src_node
 3. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 6. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (6 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext mdbnode = mdbPrev src_node
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node; mdbNext mdbnode = mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev src_node = 0
 3. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 6. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node; mdbNext mdbnode = mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev src_node = 0
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (6 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node; mdbNext mdbnode = mdbPrev src_node; mdbNext mdbnode = src\<rbrakk> \<Longrightarrow> mdbPrev src_node = 0
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node; mdbNext mdbnode = mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext mdbnode = src
 3. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 6. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (6 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node; mdbNext mdbnode = mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext mdbnode = src
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node; mdbNext mdbnode = mdbPrev src_node; mdbNext mdbnode = src\<rbrakk> \<Longrightarrow> mdbPrev src_node = 0
 3. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 6. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbPrev src_node; mdbNext mdbnode = mdbPrev src_node; mdbNext mdbnode = src\<rbrakk> \<Longrightarrow> mdbPrev src_node = 0
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src; mdbPrev mdbnode \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> (mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src; mdbPrev mdbnode \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev mdbnode = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src; mdbPrev mdbnode \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbNext src_node; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src; mdbPrev mdbnode \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (5 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode = mdbNext src_node; mdbNext src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node
 2. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src; mdbPrev mdbnode \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 5. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap mdbnode); mdbPrev mdbnode \<noteq> dest; mdbPrev mdbnode \<noteq> src; mdbPrev mdbnode \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev mdbnode \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 4. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE cap_ mdbnode_); mdbPrev mdbnode_ \<noteq> dest; mdbPrev mdbnode_ \<noteq> src; mdbPrev mdbnode_ \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbPrev mdbnode_ \<noteq> mdbNext src_node \<longrightarrow> mdbPrev mdbnode_ \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev mdbnode_) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 3. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = dest proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbPrev node = dest \<longrightarrow> dest = 0) \<and> (mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))))
 2. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbPrev node) = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> mdbPrev node; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbPrev node; m p = Some (CTE cap node); dest = mdbPrev node\<rbrakk> \<Longrightarrow> mdbPrev node = 0
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p))))
 3. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbPrev node \<noteq> dest \<longrightarrow> (mdbPrev node = src \<longrightarrow> p = 0) \<and> (mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p))))
 2. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbPrev node \<noteq> dest\<rbrakk> \<Longrightarrow> mdbPrev node \<noteq> src \<longrightarrow> (mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)))
 2. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbPrev node \<noteq> dest; mdbPrev node \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbPrev node \<noteq> dest; mdbPrev node \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p))
 3. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbPrev node = mdbPrev src_node; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbPrev node \<noteq> dest; mdbPrev node \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p))
 3. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbPrev node = mdbPrev src_node; mdbPrev src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbPrev node \<noteq> dest; mdbPrev node \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p))
 3. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p_ \<noteq> mdbNext src_node; p_ \<noteq> mdbPrev src_node; p_ \<noteq> src; p_ \<noteq> dest; m p_ = Some (CTE cap_ node_); mdbPrev node_ = mdbPrev src_node; mdbPrev src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p_ proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbPrev node \<noteq> dest; mdbPrev node \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev node \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbPrev node \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node) = Some cte' \<and> mdbNext (cteMDBNode cte') = p))
 2. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p_ \<noteq> mdbNext src_node; p_ \<noteq> mdbPrev src_node; p_ \<noteq> src; p_ \<noteq> dest; m p_ = Some (CTE cap_ node_); mdbPrev node_ \<noteq> dest; mdbPrev node_ \<noteq> src\<rbrakk> \<Longrightarrow> mdbPrev node_ \<noteq> mdbPrev src_node \<longrightarrow> (mdbPrev node_ = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbNext (cteMDBNode cte') = p_)) \<and> (mdbPrev node_ \<noteq> mdbNext src_node \<longrightarrow> mdbPrev node_ \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev node_) = Some cte' \<and> mdbNext (cteMDBNode cte') = p_)) proof (prove)
goal (1 subgoal):
 1. \<And>p cte cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) p = Some cte; cte = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. modify_map (modify_map (m(dest \<mapsto> CTE cap' src_node, src \<mapsto> CTE capability.NullCap nullMDBNode)) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest \<noteq> 0 \<longrightarrow> mdbPrev src_node = 0 \<and> mdbNext src_node = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbNext src_node) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)))))
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (4 subgoals):
 1. \<And>cap node z x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = CTE cap node; z = CTE x1 x2\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest \<noteq> 0 \<longrightarrow> mdbPrev src_node = 0 \<and> mdbNext src_node = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbNext src_node) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)))))
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (4 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2)\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> dest \<longrightarrow> (mdbNext x2 = src \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext x2 \<noteq> src \<longrightarrow> (mdbNext x2 = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)) \<and> (mdbNext x2 \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext x2 = mdbNext src_node \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node))))
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (4 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> src \<longrightarrow> (mdbNext x2 = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)) \<and> (mdbNext x2 \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext x2 = mdbNext src_node \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)))
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (5 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext x2 = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)
 2. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext x2 = mdbNext src_node \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node))
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (5 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 = mdbPrev src_node; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node
 2. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext x2 = mdbNext src_node \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node))
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (5 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 = mdbPrev src_node; mdbPrev src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node
 2. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext x2 = mdbNext src_node \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node))
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; m (mdbNext src_node) = Some (CTE cap_ x2_); mdbNext x2_ = mdbPrev src_node; mdbPrev src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node proof (prove)
goal (4 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext x2 = mdbNext src_node \<longrightarrow> mdbNext src_node = 0) \<and> (mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node))
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (5 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src; mdbNext x2 \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext x2 = mdbNext src_node \<longrightarrow> mdbNext src_node = 0
 2. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src; mdbNext x2 \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (5 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 = mdbNext src_node\<rbrakk> \<Longrightarrow> mdbNext src_node = 0
 2. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src; mdbNext x2 \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (5 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 = mdbNext src_node; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> mdbNext src_node = 0
 2. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src; mdbNext x2 \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 5. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap_ x2_); mdbNext x2_ = mdbNext src_node; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> mdbNext src_node = 0 proof (prove)
goal (4 subgoals):
 1. \<And>cap x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap x2); mdbNext x2 \<noteq> dest; mdbNext x2 \<noteq> src; mdbNext x2 \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext x2 \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2 \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 4. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE cap_ x2_); mdbNext x2_ \<noteq> dest; mdbNext x2_ \<noteq> src; mdbNext x2_ \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext x2_ \<noteq> mdbNext src_node \<longrightarrow> mdbNext x2_ \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext x2_) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node) proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (3 subgoals):
 1. \<And>cap node z x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = CTE cap node; mdbNext node \<noteq> dest; z = CTE x1 x2\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node = mdbPrev src_node) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node))))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 3. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev src_node) = Some z_; cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z_ = CTE cap_ node_; mdbNext node_ \<noteq> dest; z_ = CTE x1_ x2_\<rbrakk> \<Longrightarrow> (mdbNext node_ = src \<longrightarrow> mdbPrev src_node = 0) \<and> (mdbNext node_ \<noteq> src \<longrightarrow> (mdbNext node_ = mdbPrev src_node \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> mdbPrev node_ = mdbPrev src_node) \<and> (mdbNext node_ \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node_ = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)) \<and> (mdbNext node_ \<noteq> mdbNext src_node \<longrightarrow> mdbNext node_ \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node_) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbPrev src_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = dest proof (prove)
goal (1 subgoal):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext node = dest \<longrightarrow> dest = 0) \<and> (mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = dest \<longrightarrow> dest = 0
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext node) = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> mdbNext node; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext node; m p = Some (CTE cap node); dest = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext node = 0
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)))) proof (prove)
goal (1 subgoal):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> dest \<longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)))) proof (prove)
goal (1 subgoal):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbNext node = src \<longrightarrow> p = 0) \<and> (mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)))) proof (prove)
goal (1 subgoal):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> src \<longrightarrow> (mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext node = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> mdbPrev src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node = mdbPrev src_node; mdbPrev src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node = mdbPrev src_node; mdbPrev src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p_ \<noteq> mdbNext src_node; p_ \<noteq> mdbPrev src_node; p_ \<noteq> src; p_ \<noteq> dest; m p_ = Some (CTE cap_ node_); mdbNext node_ = mdbPrev src_node; mdbPrev src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbPrev src_node) = Some z \<and> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p_ proof (prove)
goal (1 subgoal):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> mdbPrev src_node \<longrightarrow> (mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)) \<and> (mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src; mdbNext node \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext node = mdbNext src_node \<longrightarrow> mdbNext src_node \<noteq> 0 \<longrightarrow> (\<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p)
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src; mdbNext node \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node = mdbNext src_node; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src; mdbNext node \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node = mdbNext src_node; mdbNext src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p
 2. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src; mdbNext node \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p_ \<noteq> mdbNext src_node; p_ \<noteq> mdbPrev src_node; p_ \<noteq> src; p_ \<noteq> dest; m p_ = Some (CTE cap_ node_); mdbNext node_ = mdbNext src_node; mdbNext src_node \<noteq> 0; (mdbPrev (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbNext (cteMDBNode cte') = src)) \<and> (mdbNext (cteMDBNode (CTE src_cap src_node)) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode (CTE src_cap src_node))) = Some cte' \<and> mdbPrev (cteMDBNode cte') = src))\<rbrakk> \<Longrightarrow> \<exists>cte'. (\<exists>z. m (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)) z = cte') \<and> mdbPrev (cteMDBNode cte') = p_ proof (prove)
goal (1 subgoal):
 1. \<And>p cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> dest; m p = Some (CTE cap node); mdbNext node \<noteq> dest; mdbNext node \<noteq> src; mdbNext node \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext node \<noteq> mdbNext src_node \<longrightarrow> mdbNext node \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE capability.NullCap old_dest_node); mdbPrev old_dest_node = 0; src \<noteq> dest; mdbNext old_dest_node = 0; \<forall>p cte. m p = Some cte \<longrightarrow> (mdbPrev (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p)) \<and> (mdbNext (cteMDBNode cte) \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p)); m 0 = None; p_ \<noteq> mdbNext src_node; p_ \<noteq> mdbPrev src_node; p_ \<noteq> src; p_ \<noteq> dest; m p_ = Some (CTE cap_ node_); mdbNext node_ \<noteq> dest; mdbNext node_ \<noteq> src; mdbNext node_ \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdbNext node_ \<noteq> mdbNext src_node \<longrightarrow> mdbNext node_ \<noteq> 0 \<longrightarrow> (\<exists>cte'. m (mdbNext node_) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p_) proof (prove)
goal:
No subgoals!