theory CSpace_I

lemma sameRegionAs_def2:
 "sameRegionAs cap cap' = (\<lambda>cap cap'.
     (cap = cap'
          \<and> (\<not> isNullCap cap \<and> \<not> isZombie cap
              \<and> \<not> isUntypedCap cap \<and> \<not> isArchPageCap cap)
          \<and> (\<not> isNullCap cap' \<and> \<not> isZombie cap'
              \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap'))
      \<or> (capRange cap' \<noteq> {} \<and> capRange cap' \<subseteq> capRange cap
                 \<and> (isUntypedCap cap \<or> (isArchPageCap cap \<and> isArchPageCap cap')))
      \<or> (isIRQControlCap cap \<and> isIRQHandlerCap cap'))
           (capMasterCap cap) (capMasterCap cap')" apply (cases "isUntypedCap cap") apply (clarsimp simp: sameRegionAs_def Let_def
                         isCap_Master capRange_Master capClass_Master) apply (clarsimp simp: isCap_simps
                         capMasterCap_def[where cap="UntypedCap d p n f" for d p n f]) apply (simp add: capRange_def capUntypedSize_capBits) apply (intro impI iffI) apply (clarsimp del: subsetI intro!: range_subsetI) apply clarsimp apply (simp add: range_subset_eq2) apply (simp cong: conj_cong) apply (simp     add: capMasterCap_def sameRegionAs_def isArchPageCap_def
                split: capability.split
            split del: if_split cong: if_cong) apply (simp    add: ARM_H.sameRegionAs_def isCap_simps
               split: arch_capability.split
           split del: if_split cong: if_cong) apply (clarsimp simp: capRange_def Let_def) apply (simp add: range_subset_eq2 cong: conj_cong) by (simp add: conj_comms)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (2 subgoals):
 1. isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap'))
 2. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (2 subgoals):
 1. isUntypedCap cap \<Longrightarrow> (capClass cap' = PhysicalClass \<and> capPtr cap \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + global.capUntypedSize cap' - 1 \<le> capPtr cap + 2 ^ capBlockSize cap - 1 \<and> global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + global.capUntypedSize cap' - 1) = (capRange cap' \<noteq> {} \<and> capRange cap' \<subseteq> capRange cap \<or> isIRQControlCap cap \<and> isIRQHandlerCap cap')
 2. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (2 subgoals):
 1. \<And>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f \<Longrightarrow> (capClass cap' = PhysicalClass \<and> v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + global.capUntypedSize cap' - 1 \<le> v0 + 2 ^ v1 - 1 \<and> global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + global.capUntypedSize cap' - 1) = (capRange cap' \<noteq> {} \<and> capRange cap' \<subseteq> {v0..v0 + 2 ^ v1 - 1})
 2. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (2 subgoals):
 1. \<And>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f \<Longrightarrow> capClass cap' = PhysicalClass \<longrightarrow> (v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<le> v0 + 2 ^ v1 - 1 \<and> global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1) = (global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<and> (global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<longrightarrow> v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<le> v0 + 2 ^ v1 - 1))
 2. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (3 subgoals):
 1. \<And>d v0 v1 f. \<lbrakk>cap = capability.UntypedCap d v0 v1 f; capClass cap' = PhysicalClass; v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<le> v0 + 2 ^ v1 - 1 \<and> global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1\<rbrakk> \<Longrightarrow> global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<and> (global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<longrightarrow> v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<le> v0 + 2 ^ v1 - 1)
 2. \<And>d v0 v1 f. \<lbrakk>cap = capability.UntypedCap d v0 v1 f; capClass cap' = PhysicalClass; global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<and> (global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<longrightarrow> v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<le> v0 + 2 ^ v1 - 1)\<rbrakk> \<Longrightarrow> v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<le> v0 + 2 ^ v1 - 1 \<and> global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1
 3. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (2 subgoals):
 1. \<And>d v0 v1 f. \<lbrakk>cap = capability.UntypedCap d v0 v1 f; capClass cap' = PhysicalClass; global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<and> (global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<longrightarrow> v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<le> v0 + 2 ^ v1 - 1)\<rbrakk> \<Longrightarrow> v0 \<le> global.capUntypedPtr cap' \<and> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1 \<le> v0 + 2 ^ v1 - 1 \<and> global.capUntypedPtr cap' \<le> global.capUntypedPtr cap' + 2 ^ capBits cap' - 1
 2. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (1 subgoal):
 1. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> (\<not> isNullCap (capMasterCap cap) \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)) \<and> \<not> isNullCap (capMasterCap cap') \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (1 subgoal):
 1. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> capMasterCap cap \<noteq> capability.NullCap \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap) \<and> capMasterCap cap' \<noteq> capability.NullCap \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (1 subgoal):
 1. \<not> isUntypedCap cap \<Longrightarrow> global.sameRegionAs cap cap' = (capMasterCap cap = capMasterCap cap' \<and> capMasterCap cap' \<noteq> capability.NullCap \<and> \<not> isZombie (capMasterCap cap') \<and> \<not> isUntypedCap (capMasterCap cap') \<and> \<not> isArchPageCap (capMasterCap cap') \<or> capRange (capMasterCap cap') \<noteq> {} \<and> capRange (capMasterCap cap') \<subseteq> capRange (capMasterCap cap) \<and> (isUntypedCap (capMasterCap cap) \<or> isArchPageCap (capMasterCap cap) \<and> isArchPageCap (capMasterCap cap')) \<or> isIRQControlCap (capMasterCap cap) \<and> isIRQHandlerCap (capMasterCap cap')) proof (prove)
goal (1 subgoal):
 1. \<not> isUntypedCap cap \<Longrightarrow> (\<forall>x1. cap = capability.ThreadCap x1 \<longrightarrow> (\<forall>x1a. cap' = capability.ThreadCap x1a \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.ThreadCap x1a) then capEPPtr (capability.ThreadCap x1) = capEPPtr (capability.ThreadCap x1a) else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.ThreadCap x1a) then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr (capability.ThreadCap x1a) else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.ThreadCap x1a) then capCNodePtr (capability.ThreadCap x1) = capCNodePtr (capability.ThreadCap x1a) \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits (capability.ThreadCap x1a) else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.ThreadCap x1a) then x1 = x1a else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.ThreadCap x1a) then x1 = x1a else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.ThreadCap x1a) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ThreadCap x1a) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ThreadCap x1a) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.ThreadCap x1a) then undefined else False) = (x1 = x1a \<and> \<not> isZombie (capability.ThreadCap x1a) \<and> \<not> isUntypedCap (capability.ThreadCap x1a) \<or> capRange (capability.ThreadCap x1a) \<noteq> {} \<and> capRange (capability.ThreadCap x1a) \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ThreadCap x1a))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap capability.NullCap then capEPPtr (capability.ThreadCap x1) = capEPPtr capability.NullCap else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap capability.NullCap then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr capability.NullCap else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap capability.NullCap then capCNodePtr (capability.ThreadCap x1) = capCNodePtr capability.NullCap \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits capability.NullCap else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap capability.NullCap then x1 = capTCBPtr capability.NullCap else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap capability.NullCap then x1 = capTCBPtr capability.NullCap else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr (capability.ThreadCap x1) = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr (capability.ThreadCap x1) = x31 else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr (capability.ThreadCap x1) = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then x1 = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then x1 = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr (capability.ThreadCap x1) = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr (capability.ThreadCap x1) = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.IRQHandlerCap x4) then x1 = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.IRQHandlerCap x4) then x1 = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr (capability.ThreadCap x1) = x51 else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr (capability.ThreadCap x1) = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then x1 = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then x1 = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap capability.DomainCap then capEPPtr (capability.ThreadCap x1) = capEPPtr capability.DomainCap else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap capability.DomainCap then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap capability.DomainCap then capCNodePtr (capability.ThreadCap x1) = capCNodePtr capability.DomainCap \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits capability.DomainCap else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap capability.DomainCap then x1 = capTCBPtr capability.DomainCap else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap capability.DomainCap then x1 = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr (capability.ThreadCap x1) = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr (capability.ThreadCap x1) = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.Zombie x71 x72 x73) then x1 = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.Zombie x71 x72 x73) then x1 = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr (capability.ThreadCap x1) = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr (capability.ThreadCap x1) = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.ArchObjectCap x8) then x1 = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.ArchObjectCap x8) then x1 = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr (capability.ThreadCap x1) = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr (capability.ThreadCap x1) = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then x1 = x91 else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then x1 = x91 else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr (capability.ThreadCap x1) = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr (capability.ThreadCap x1) = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then x1 = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then x1 = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr (capability.ThreadCap x1) = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr (capability.ThreadCap x1) = x111 \<and> capCNodeBits (capability.ThreadCap x1) = x112 else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then x1 = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then x1 = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.ThreadCap x1) \<and> isEndpointCap capability.IRQControlCap then capEPPtr (capability.ThreadCap x1) = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.ThreadCap x1) \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr (capability.ThreadCap x1) = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.ThreadCap x1) \<and> isCNodeCap capability.IRQControlCap then capCNodePtr (capability.ThreadCap x1) = capCNodePtr capability.IRQControlCap \<and> capCNodeBits (capability.ThreadCap x1) = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.ThreadCap x1) \<and> isThreadCap capability.IRQControlCap then x1 = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.ThreadCap x1) \<and> isReplyCap capability.IRQControlCap then x1 = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.ThreadCap x1) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange (capability.ThreadCap x1) \<and> isUntypedCap (capability.ThreadCap x1) \<or> isIRQControlCap (capability.ThreadCap x1) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (cap = capability.NullCap \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr capability.NullCap = capEPPtr (capability.ThreadCap x1) else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr capability.NullCap = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr capability.NullCap = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits capability.NullCap = capCNodeBits (capability.ThreadCap x1) else if isThreadCap capability.NullCap \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr capability.NullCap = x1 else if isReplyCap capability.NullCap \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr capability.NullCap = x1 else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap capability.NullCap then True else if isNotificationCap capability.NullCap then True else if isCNodeCap capability.NullCap then True else if isThreadCap capability.NullCap then True else if isReplyCap capability.NullCap then True else if isIRQControlCap capability.NullCap then True else if isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap capability.NullCap then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr capability.NullCap = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr capability.NullCap = x31 else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr capability.NullCap = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits capability.NullCap = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap capability.NullCap \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr capability.NullCap = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap capability.NullCap \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr capability.NullCap = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr capability.NullCap = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr capability.NullCap = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr capability.NullCap = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits capability.NullCap = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap capability.NullCap \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr capability.NullCap = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap capability.NullCap \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr capability.NullCap = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr capability.NullCap = x51 else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr capability.NullCap = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr capability.NullCap = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits capability.NullCap = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap capability.NullCap \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr capability.NullCap = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap capability.NullCap \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr capability.NullCap = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap capability.DomainCap then capEPPtr capability.NullCap = capEPPtr capability.DomainCap else if isNotificationCap capability.NullCap \<and> isNotificationCap capability.DomainCap then capNtfnPtr capability.NullCap = capNtfnPtr capability.DomainCap else if isCNodeCap capability.NullCap \<and> isCNodeCap capability.DomainCap then capCNodePtr capability.NullCap = capCNodePtr capability.DomainCap \<and> capCNodeBits capability.NullCap = capCNodeBits capability.DomainCap else if isThreadCap capability.NullCap \<and> isThreadCap capability.DomainCap then capTCBPtr capability.NullCap = capTCBPtr capability.DomainCap else if isReplyCap capability.NullCap \<and> isReplyCap capability.DomainCap then capTCBPtr capability.NullCap = capTCBPtr capability.DomainCap else if isIRQControlCap capability.NullCap \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap capability.DomainCap then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr capability.NullCap = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr capability.NullCap = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr capability.NullCap = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits capability.NullCap = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap capability.NullCap \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr capability.NullCap = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap capability.NullCap \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr capability.NullCap = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr capability.NullCap = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr capability.NullCap = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr capability.NullCap = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits capability.NullCap = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap capability.NullCap \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr capability.NullCap = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap capability.NullCap \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr capability.NullCap = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr capability.NullCap = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr capability.NullCap = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr capability.NullCap = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits capability.NullCap = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap capability.NullCap \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr capability.NullCap = x91 else if isReplyCap capability.NullCap \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr capability.NullCap = x91 else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr capability.NullCap = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr capability.NullCap = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr capability.NullCap = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits capability.NullCap = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap capability.NullCap \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr capability.NullCap = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap capability.NullCap \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr capability.NullCap = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr capability.NullCap = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap capability.NullCap \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr capability.NullCap = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap capability.NullCap \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr capability.NullCap = x111 \<and> capCNodeBits capability.NullCap = x112 else if isThreadCap capability.NullCap \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr capability.NullCap = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap capability.NullCap \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr capability.NullCap = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap capability.NullCap \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap capability.NullCap \<and> isEndpointCap capability.IRQControlCap then capEPPtr capability.NullCap = capEPPtr capability.IRQControlCap else if isNotificationCap capability.NullCap \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr capability.NullCap = capNtfnPtr capability.IRQControlCap else if isCNodeCap capability.NullCap \<and> isCNodeCap capability.IRQControlCap then capCNodePtr capability.NullCap = capCNodePtr capability.IRQControlCap \<and> capCNodeBits capability.NullCap = capCNodeBits capability.IRQControlCap else if isThreadCap capability.NullCap \<and> isThreadCap capability.IRQControlCap then capTCBPtr capability.NullCap = capTCBPtr capability.IRQControlCap else if isReplyCap capability.NullCap \<and> isReplyCap capability.IRQControlCap then capTCBPtr capability.NullCap = capTCBPtr capability.IRQControlCap else if isIRQControlCap capability.NullCap \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap capability.NullCap \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap capability.NullCap \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap capability.NullCap \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (isIRQControlCap capability.NullCap \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (\<forall>x31 x32 x33 x34. cap = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr (capability.ThreadCap x1) else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.ThreadCap x1) then x31 = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits (capability.ThreadCap x1) else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = x1 else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = x1 else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap capability.NullCap then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr capability.NullCap else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap capability.NullCap then x31 = capNtfnPtr capability.NullCap else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap capability.NullCap then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr capability.NullCap \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits capability.NullCap else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap capability.NullCap then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr capability.NullCap else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap capability.NullCap then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr capability.NullCap else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31a x32a x33a x34a. cap' = capability.NotificationCap x31a x32a x33a x34a \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.NotificationCap x31a x32a x33a x34a) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr (capability.NotificationCap x31a x32a x33a x34a) else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.NotificationCap x31a x32a x33a x34a) then x31 = x31a else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.NotificationCap x31a x32a x33a x34a) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr (capability.NotificationCap x31a x32a x33a x34a) \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits (capability.NotificationCap x31a x32a x33a x34a) else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.NotificationCap x31a x32a x33a x34a) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.NotificationCap x31a x32a x33a x34a) else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.NotificationCap x31a x32a x33a x34a) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.NotificationCap x31a x32a x33a x34a) else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.NotificationCap x31a x32a x33a x34a) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.NotificationCap x31a x32a x33a x34a) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.NotificationCap x31a x32a x33a x34a) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.NotificationCap x31a x32a x33a x34a) then undefined else False) = (x31 = x31a \<and> \<not> isZombie (capability.NotificationCap x31a 0 True True) \<and> \<not> isUntypedCap (capability.NotificationCap x31a 0 True True) \<or> capRange (capability.NotificationCap x31a 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31a 0 True True) \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.NotificationCap x31a 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.IRQHandlerCap x4) then x31 = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = x51 else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then x31 = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap capability.DomainCap then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr capability.DomainCap else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap capability.DomainCap then x31 = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap capability.DomainCap then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr capability.DomainCap \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits capability.DomainCap else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap capability.DomainCap then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr capability.DomainCap else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap capability.DomainCap then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.Zombie x71 x72 x73) then x31 = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.ArchObjectCap x8) then x31 = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then x31 = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = x91 else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = x91 else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then x31 = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then x31 = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = x111 \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = x112 else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.NotificationCap x31 x32 x33 x34) \<and> isEndpointCap capability.IRQControlCap then capEPPtr (capability.NotificationCap x31 x32 x33 x34) = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.NotificationCap x31 x32 x33 x34) \<and> isNotificationCap capability.IRQControlCap then x31 = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.NotificationCap x31 x32 x33 x34) \<and> isCNodeCap capability.IRQControlCap then capCNodePtr (capability.NotificationCap x31 x32 x33 x34) = capCNodePtr capability.IRQControlCap \<and> capCNodeBits (capability.NotificationCap x31 x32 x33 x34) = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.NotificationCap x31 x32 x33 x34) \<and> isThreadCap capability.IRQControlCap then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.NotificationCap x31 x32 x33 x34) \<and> isReplyCap capability.IRQControlCap then capTCBPtr (capability.NotificationCap x31 x32 x33 x34) = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange (capability.NotificationCap x31 0 True True) \<and> isUntypedCap (capability.NotificationCap x31 0 True True) \<or> isIRQControlCap (capability.NotificationCap x31 0 True True) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (\<forall>x4. cap = capability.IRQHandlerCap x4 \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr (capability.ThreadCap x1) else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits (capability.ThreadCap x1) else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr (capability.IRQHandlerCap x4) = x1 else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr (capability.IRQHandlerCap x4) = x1 else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap capability.NullCap then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr capability.NullCap else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap capability.NullCap then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr capability.NullCap else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap capability.NullCap then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr capability.NullCap \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits capability.NullCap else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap capability.NullCap then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr capability.NullCap else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap capability.NullCap then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr capability.NullCap else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr (capability.IRQHandlerCap x4) = x31 else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4a. cap' = capability.IRQHandlerCap x4a \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.IRQHandlerCap x4a) then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr (capability.IRQHandlerCap x4a) else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.IRQHandlerCap x4a) then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr (capability.IRQHandlerCap x4a) else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.IRQHandlerCap x4a) then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr (capability.IRQHandlerCap x4a) \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits (capability.IRQHandlerCap x4a) else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.IRQHandlerCap x4a) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.IRQHandlerCap x4a) else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.IRQHandlerCap x4a) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.IRQHandlerCap x4a) else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.IRQHandlerCap x4a) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4a) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4a) then x4 = x4a else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.IRQHandlerCap x4a) then undefined else False) = (x4 = x4a \<and> \<not> isZombie (capability.IRQHandlerCap x4a) \<and> \<not> isUntypedCap (capability.IRQHandlerCap x4a) \<or> capRange (capability.IRQHandlerCap x4a) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4a) \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4a))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr (capability.IRQHandlerCap x4) = x51 else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap capability.DomainCap then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr capability.DomainCap else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap capability.DomainCap then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap capability.DomainCap then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr capability.DomainCap \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits capability.DomainCap else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap capability.DomainCap then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr capability.DomainCap else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap capability.DomainCap then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.IRQHandlerCap x4) = x91 else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.IRQHandlerCap x4) = x91 else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr (capability.IRQHandlerCap x4) = x111 \<and> capCNodeBits (capability.IRQHandlerCap x4) = x112 else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.IRQHandlerCap x4) \<and> isEndpointCap capability.IRQControlCap then capEPPtr (capability.IRQHandlerCap x4) = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.IRQHandlerCap x4) \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr (capability.IRQHandlerCap x4) = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.IRQHandlerCap x4) \<and> isCNodeCap capability.IRQControlCap then capCNodePtr (capability.IRQHandlerCap x4) = capCNodePtr capability.IRQControlCap \<and> capCNodeBits (capability.IRQHandlerCap x4) = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.IRQHandlerCap x4) \<and> isThreadCap capability.IRQControlCap then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.IRQHandlerCap x4) \<and> isReplyCap capability.IRQControlCap then capTCBPtr (capability.IRQHandlerCap x4) = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.IRQHandlerCap x4) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange (capability.IRQHandlerCap x4) \<and> isUntypedCap (capability.IRQHandlerCap x4) \<or> isIRQControlCap (capability.IRQHandlerCap x4) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.ThreadCap x1) then x51 = capEPPtr (capability.ThreadCap x1) else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits (capability.ThreadCap x1) else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = x1 else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = x1 else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap capability.NullCap then x51 = capEPPtr capability.NullCap else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap capability.NullCap then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr capability.NullCap else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap capability.NullCap then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr capability.NullCap \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits capability.NullCap else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap capability.NullCap then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr capability.NullCap else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap capability.NullCap then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr capability.NullCap else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then x51 = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = x31 else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.IRQHandlerCap x4) then x51 = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51a x52a x53a x54a x55a x56a. cap' = capability.EndpointCap x51a x52a x53a x54a x55a x56a \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then x51 = x51a else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr (capability.EndpointCap x51a x52a x53a x54a x55a x56a) else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr (capability.EndpointCap x51a x52a x53a x54a x55a x56a) \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits (capability.EndpointCap x51a x52a x53a x54a x55a x56a) else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.EndpointCap x51a x52a x53a x54a x55a x56a) else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.EndpointCap x51a x52a x53a x54a x55a x56a) else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.EndpointCap x51a x52a x53a x54a x55a x56a) then undefined else False) = (x51 = x51a \<and> \<not> isZombie (capability.EndpointCap x51a 0 True True True True) \<and> \<not> isUntypedCap (capability.EndpointCap x51a 0 True True True True) \<or> capRange (capability.EndpointCap x51a 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51a 0 True True True True) \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.EndpointCap x51a 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap capability.DomainCap then x51 = capEPPtr capability.DomainCap else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap capability.DomainCap then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap capability.DomainCap then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr capability.DomainCap \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits capability.DomainCap else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap capability.DomainCap then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr capability.DomainCap else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap capability.DomainCap then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.Zombie x71 x72 x73) then x51 = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.ArchObjectCap x8) then x51 = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then x51 = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = x91 else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = x91 else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then x51 = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then x51 = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = x111 \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = x112 else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isEndpointCap capability.IRQControlCap then x51 = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isCNodeCap capability.IRQControlCap then capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodePtr capability.IRQControlCap \<and> capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isThreadCap capability.IRQControlCap then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isReplyCap capability.IRQControlCap then capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange (capability.EndpointCap x51 0 True True True True) \<and> isUntypedCap (capability.EndpointCap x51 0 True True True True) \<or> isIRQControlCap (capability.EndpointCap x51 0 True True True True) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (cap = capability.DomainCap \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr capability.DomainCap = capEPPtr (capability.ThreadCap x1) else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr capability.DomainCap = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr capability.DomainCap = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits capability.DomainCap = capCNodeBits (capability.ThreadCap x1) else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr capability.DomainCap = x1 else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr capability.DomainCap = x1 else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap capability.NullCap then capEPPtr capability.DomainCap = capEPPtr capability.NullCap else if isNotificationCap capability.DomainCap \<and> isNotificationCap capability.NullCap then capNtfnPtr capability.DomainCap = capNtfnPtr capability.NullCap else if isCNodeCap capability.DomainCap \<and> isCNodeCap capability.NullCap then capCNodePtr capability.DomainCap = capCNodePtr capability.NullCap \<and> capCNodeBits capability.DomainCap = capCNodeBits capability.NullCap else if isThreadCap capability.DomainCap \<and> isThreadCap capability.NullCap then capTCBPtr capability.DomainCap = capTCBPtr capability.NullCap else if isReplyCap capability.DomainCap \<and> isReplyCap capability.NullCap then capTCBPtr capability.DomainCap = capTCBPtr capability.NullCap else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr capability.DomainCap = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr capability.DomainCap = x31 else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr capability.DomainCap = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits capability.DomainCap = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr capability.DomainCap = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr capability.DomainCap = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr capability.DomainCap = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr capability.DomainCap = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr capability.DomainCap = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits capability.DomainCap = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr capability.DomainCap = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr capability.DomainCap = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr capability.DomainCap = x51 else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr capability.DomainCap = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr capability.DomainCap = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits capability.DomainCap = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr capability.DomainCap = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr capability.DomainCap = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> \<not> isZombie capability.DomainCap \<and> \<not> isUntypedCap capability.DomainCap \<or> capRange capability.DomainCap \<noteq> {} \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap capability.DomainCap) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr capability.DomainCap = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr capability.DomainCap = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr capability.DomainCap = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits capability.DomainCap = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr capability.DomainCap = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr capability.DomainCap = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr capability.DomainCap = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr capability.DomainCap = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr capability.DomainCap = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits capability.DomainCap = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr capability.DomainCap = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr capability.DomainCap = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr capability.DomainCap = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr capability.DomainCap = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr capability.DomainCap = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits capability.DomainCap = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr capability.DomainCap = x91 else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr capability.DomainCap = x91 else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr capability.DomainCap = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr capability.DomainCap = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr capability.DomainCap = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits capability.DomainCap = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr capability.DomainCap = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr capability.DomainCap = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr capability.DomainCap = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap capability.DomainCap \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr capability.DomainCap = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap capability.DomainCap \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr capability.DomainCap = x111 \<and> capCNodeBits capability.DomainCap = x112 else if isThreadCap capability.DomainCap \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr capability.DomainCap = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap capability.DomainCap \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr capability.DomainCap = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap capability.DomainCap \<and> isEndpointCap capability.IRQControlCap then capEPPtr capability.DomainCap = capEPPtr capability.IRQControlCap else if isNotificationCap capability.DomainCap \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr capability.DomainCap = capNtfnPtr capability.IRQControlCap else if isCNodeCap capability.DomainCap \<and> isCNodeCap capability.IRQControlCap then capCNodePtr capability.DomainCap = capCNodePtr capability.IRQControlCap \<and> capCNodeBits capability.DomainCap = capCNodeBits capability.IRQControlCap else if isThreadCap capability.DomainCap \<and> isThreadCap capability.IRQControlCap then capTCBPtr capability.DomainCap = capTCBPtr capability.IRQControlCap else if isReplyCap capability.DomainCap \<and> isReplyCap capability.IRQControlCap then capTCBPtr capability.DomainCap = capTCBPtr capability.IRQControlCap else if isIRQControlCap capability.DomainCap \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap capability.DomainCap \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap capability.DomainCap \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange capability.DomainCap \<and> isUntypedCap capability.DomainCap \<or> isIRQControlCap capability.DomainCap \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (\<forall>x71 x72 x73. cap = capability.Zombie x71 x72 x73 \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr (capability.ThreadCap x1) else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits (capability.ThreadCap x1) else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr (capability.Zombie x71 x72 x73) = x1 else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr (capability.Zombie x71 x72 x73) = x1 else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap capability.NullCap then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr capability.NullCap else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap capability.NullCap then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr capability.NullCap else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap capability.NullCap then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr capability.NullCap \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits capability.NullCap else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap capability.NullCap then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr capability.NullCap else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap capability.NullCap then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr capability.NullCap else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr (capability.Zombie x71 x72 x73) = x31 else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr (capability.Zombie x71 x72 x73) = x51 else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap capability.DomainCap then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr capability.DomainCap else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap capability.DomainCap then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap capability.DomainCap then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr capability.DomainCap \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits capability.DomainCap else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap capability.DomainCap then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr capability.DomainCap else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap capability.DomainCap then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71a x72a x73a. cap' = capability.Zombie x71a x72a x73a \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.Zombie x71a x72a x73a) then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr (capability.Zombie x71a x72a x73a) else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.Zombie x71a x72a x73a) then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr (capability.Zombie x71a x72a x73a) else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.Zombie x71a x72a x73a) then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr (capability.Zombie x71a x72a x73a) \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits (capability.Zombie x71a x72a x73a) else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.Zombie x71a x72a x73a) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.Zombie x71a x72a x73a) else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.Zombie x71a x72a x73a) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.Zombie x71a x72a x73a) else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.Zombie x71a x72a x73a) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.Zombie x71a x72a x73a) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.Zombie x71a x72a x73a) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.Zombie x71a x72a x73a) then undefined else False) = (x71 = x71a \<and> x72 = x72a \<and> x73 = x73a \<and> \<not> isZombie (capability.Zombie x71a x72a x73a) \<and> \<not> isUntypedCap (capability.Zombie x71a x72a x73a) \<or> capRange (capability.Zombie x71a x72a x73a) \<noteq> {} \<and> capRange (capability.Zombie x71a x72a x73a) \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.Zombie x71a x72a x73a))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.Zombie x71 x72 x73) = x91 else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.Zombie x71 x72 x73) = x91 else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr (capability.Zombie x71 x72 x73) = x111 \<and> capCNodeBits (capability.Zombie x71 x72 x73) = x112 else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.Zombie x71 x72 x73) \<and> isEndpointCap capability.IRQControlCap then capEPPtr (capability.Zombie x71 x72 x73) = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.Zombie x71 x72 x73) \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr (capability.Zombie x71 x72 x73) = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.Zombie x71 x72 x73) \<and> isCNodeCap capability.IRQControlCap then capCNodePtr (capability.Zombie x71 x72 x73) = capCNodePtr capability.IRQControlCap \<and> capCNodeBits (capability.Zombie x71 x72 x73) = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.Zombie x71 x72 x73) \<and> isThreadCap capability.IRQControlCap then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.Zombie x71 x72 x73) \<and> isReplyCap capability.IRQControlCap then capTCBPtr (capability.Zombie x71 x72 x73) = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.Zombie x71 x72 x73) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange (capability.Zombie x71 x72 x73) \<and> isUntypedCap (capability.Zombie x71 x72 x73) \<or> isIRQControlCap (capability.Zombie x71 x72 x73) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (\<forall>x8. cap = capability.ArchObjectCap x8 \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr (capability.ArchObjectCap x8) = capEPPtr (capability.ThreadCap x1) else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits (capability.ThreadCap x1) else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr (capability.ArchObjectCap x8) = x1 else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr (capability.ArchObjectCap x8) = x1 else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap capability.NullCap then capEPPtr (capability.ArchObjectCap x8) = capEPPtr capability.NullCap else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap capability.NullCap then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr capability.NullCap else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap capability.NullCap then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr capability.NullCap \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits capability.NullCap else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap capability.NullCap then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr capability.NullCap else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap capability.NullCap then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr capability.NullCap else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr (capability.ArchObjectCap x8) = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr (capability.ArchObjectCap x8) = x31 else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr (capability.ArchObjectCap x8) = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr (capability.ArchObjectCap x8) = x51 else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap capability.DomainCap then capEPPtr (capability.ArchObjectCap x8) = capEPPtr capability.DomainCap else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap capability.DomainCap then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap capability.DomainCap then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr capability.DomainCap \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits capability.DomainCap else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap capability.DomainCap then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr capability.DomainCap else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap capability.DomainCap then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr (capability.ArchObjectCap x8) = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8a. cap' = capability.ArchObjectCap x8a \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.ArchObjectCap x8a) then capEPPtr (capability.ArchObjectCap x8) = capEPPtr (capability.ArchObjectCap x8a) else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.ArchObjectCap x8a) then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr (capability.ArchObjectCap x8a) else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.ArchObjectCap x8a) then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr (capability.ArchObjectCap x8a) \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits (capability.ArchObjectCap x8a) else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.ArchObjectCap x8a) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.ArchObjectCap x8a) else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.ArchObjectCap x8a) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.ArchObjectCap x8a) else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.ArchObjectCap x8a) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.ArchObjectCap x8a) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.ArchObjectCap x8a) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.ArchObjectCap x8a) then Arch.sameRegionAs x8 x8a else False) = ((case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None) = (case x8a of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8a | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None) \<and> \<not> isZombie (capability.ArchObjectCap (case x8a of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8a | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> \<not> isUntypedCap (capability.ArchObjectCap (case x8a of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8a | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> \<not> (case case x8a of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8a | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None of arch_capability.PageCap d ref rghts sz data \<Rightarrow> True | _ \<Rightarrow> False) \<or> capRange (capability.ArchObjectCap (case x8a of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8a | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8a of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8a | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> (isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> (case case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None of arch_capability.PageCap d ref rghts sz data \<Rightarrow> True | _ \<Rightarrow> False) \<and> (case case x8a of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8a | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None of arch_capability.PageCap d ref rghts sz data \<Rightarrow> True | _ \<Rightarrow> False)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8a of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8a | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr (capability.ArchObjectCap x8) = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.ArchObjectCap x8) = x91 else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.ArchObjectCap x8) = x91 else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr (capability.ArchObjectCap x8) = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr (capability.ArchObjectCap x8) = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr (capability.ArchObjectCap x8) = x111 \<and> capCNodeBits (capability.ArchObjectCap x8) = x112 else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.ArchObjectCap x8) \<and> isEndpointCap capability.IRQControlCap then capEPPtr (capability.ArchObjectCap x8) = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.ArchObjectCap x8) \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr (capability.ArchObjectCap x8) = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.ArchObjectCap x8) \<and> isCNodeCap capability.IRQControlCap then capCNodePtr (capability.ArchObjectCap x8) = capCNodePtr capability.IRQControlCap \<and> capCNodeBits (capability.ArchObjectCap x8) = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.ArchObjectCap x8) \<and> isThreadCap capability.IRQControlCap then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.ArchObjectCap x8) \<and> isReplyCap capability.IRQControlCap then capTCBPtr (capability.ArchObjectCap x8) = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.ArchObjectCap x8) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.ArchObjectCap x8) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isUntypedCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<or> isIRQControlCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (\<forall>x91 x92 x93. cap = capability.ReplyCap x91 x92 x93 \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr (capability.ThreadCap x1) else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits (capability.ThreadCap x1) else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.ThreadCap x1) then x91 = x1 else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.ThreadCap x1) then x91 = x1 else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap capability.NullCap then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr capability.NullCap else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap capability.NullCap then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr capability.NullCap else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap capability.NullCap then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr capability.NullCap \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits capability.NullCap else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap capability.NullCap then x91 = capTCBPtr capability.NullCap else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap capability.NullCap then x91 = capTCBPtr capability.NullCap else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = x31 else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then x91 = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then x91 = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.IRQHandlerCap x4) then x91 = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.IRQHandlerCap x4) then x91 = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr (capability.ReplyCap x91 x92 x93) = x51 else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then x91 = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then x91 = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap capability.DomainCap then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr capability.DomainCap else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap capability.DomainCap then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap capability.DomainCap then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr capability.DomainCap \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits capability.DomainCap else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap capability.DomainCap then x91 = capTCBPtr capability.DomainCap else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap capability.DomainCap then x91 = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.Zombie x71 x72 x73) then x91 = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.Zombie x71 x72 x73) then x91 = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.ArchObjectCap x8) then x91 = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.ArchObjectCap x8) then x91 = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91a x92a x93a. cap' = capability.ReplyCap x91a x92a x93a \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.ReplyCap x91a x92a x93a) then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr (capability.ReplyCap x91a x92a x93a) else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.ReplyCap x91a x92a x93a) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr (capability.ReplyCap x91a x92a x93a) else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.ReplyCap x91a x92a x93a) then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr (capability.ReplyCap x91a x92a x93a) \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits (capability.ReplyCap x91a x92a x93a) else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.ReplyCap x91a x92a x93a) then x91 = x91a else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.ReplyCap x91a x92a x93a) then x91 = x91a else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.ReplyCap x91a x92a x93a) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.ReplyCap x91a x92a x93a) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.ReplyCap x91a x92a x93a) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.ReplyCap x91a x92a x93a) then undefined else False) = (x91 = x91a \<and> \<not> isZombie (capability.ReplyCap x91a True True) \<and> \<not> isUntypedCap (capability.ReplyCap x91a True True) \<or> capRange (capability.ReplyCap x91a True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91a True True) \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.ReplyCap x91a True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then x91 = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then x91 = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr (capability.ReplyCap x91 x92 x93) = x111 \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = x112 else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then x91 = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then x91 = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.ReplyCap x91 x92 x93) \<and> isEndpointCap capability.IRQControlCap then capEPPtr (capability.ReplyCap x91 x92 x93) = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.ReplyCap x91 x92 x93) \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr (capability.ReplyCap x91 x92 x93) = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.ReplyCap x91 x92 x93) \<and> isCNodeCap capability.IRQControlCap then capCNodePtr (capability.ReplyCap x91 x92 x93) = capCNodePtr capability.IRQControlCap \<and> capCNodeBits (capability.ReplyCap x91 x92 x93) = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.ReplyCap x91 x92 x93) \<and> isThreadCap capability.IRQControlCap then x91 = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.ReplyCap x91 x92 x93) \<and> isReplyCap capability.IRQControlCap then x91 = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.ReplyCap x91 x92 x93) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.ReplyCap x91 x92 x93) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange (capability.ReplyCap x91 True True) \<and> isUntypedCap (capability.ReplyCap x91 True True) \<or> isIRQControlCap (capability.ReplyCap x91 True True) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (\<forall>x101 x102 x103 x104. cap = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr (capability.ThreadCap x1) else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits (capability.ThreadCap x1) else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = x1 else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = x1 else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap capability.NullCap then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr capability.NullCap else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap capability.NullCap then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr capability.NullCap else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap capability.NullCap then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr capability.NullCap \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits capability.NullCap else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap capability.NullCap then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr capability.NullCap else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap capability.NullCap then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr capability.NullCap else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = x31 else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = x51 else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap capability.DomainCap then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr capability.DomainCap else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap capability.DomainCap then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap capability.DomainCap then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr capability.DomainCap \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits capability.DomainCap else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap capability.DomainCap then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr capability.DomainCap else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap capability.DomainCap then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = x91 else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = x91 else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101a x102a x103a x104a. cap' = capability.UntypedCap x101a x102a x103a x104a \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.UntypedCap x101a x102a x103a x104a) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr (capability.UntypedCap x101a x102a x103a x104a) else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.UntypedCap x101a x102a x103a x104a) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr (capability.UntypedCap x101a x102a x103a x104a) else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.UntypedCap x101a x102a x103a x104a) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr (capability.UntypedCap x101a x102a x103a x104a) \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits (capability.UntypedCap x101a x102a x103a x104a) else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.UntypedCap x101a x102a x103a x104a) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.UntypedCap x101a x102a x103a x104a) else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.UntypedCap x101a x102a x103a x104a) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.UntypedCap x101a x102a x103a x104a) else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.UntypedCap x101a x102a x103a x104a) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.UntypedCap x101a x102a x103a x104a) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.UntypedCap x101a x102a x103a x104a) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.UntypedCap x101a x102a x103a x104a) then undefined else False) = (x101 = x101a \<and> x102 = x102a \<and> x103 = x103a \<and> \<not> isZombie (capability.UntypedCap x101a x102a x103a 0) \<and> \<not> isUntypedCap (capability.UntypedCap x101a x102a x103a 0) \<or> x102a \<le> x102a + 2 ^ x103a - 1 \<and> (x102a \<le> x102a + 2 ^ x103a - 1 \<longrightarrow> x102 \<le> x102a \<and> x102a + 2 ^ x103a - 1 \<le> x102 + 2 ^ x103 - 1) \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.UntypedCap x101a x102a x103a 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = x111 \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = x112 else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.UntypedCap x101 x102 x103 x104) \<and> isEndpointCap capability.IRQControlCap then capEPPtr (capability.UntypedCap x101 x102 x103 x104) = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.UntypedCap x101 x102 x103 x104) \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.UntypedCap x101 x102 x103 x104) \<and> isCNodeCap capability.IRQControlCap then capCNodePtr (capability.UntypedCap x101 x102 x103 x104) = capCNodePtr capability.IRQControlCap \<and> capCNodeBits (capability.UntypedCap x101 x102 x103 x104) = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.UntypedCap x101 x102 x103 x104) \<and> isThreadCap capability.IRQControlCap then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.UntypedCap x101 x102 x103 x104) \<and> isReplyCap capability.IRQControlCap then capTCBPtr (capability.UntypedCap x101 x102 x103 x104) = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> {x102..x102 + 2 ^ x103 - 1} \<and> isUntypedCap (capability.UntypedCap x101 x102 x103 0) \<or> isIRQControlCap (capability.UntypedCap x101 x102 x103 0) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (\<forall>x111 x112 x113 x114. cap = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr (capability.ThreadCap x1) else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.ThreadCap x1) then x111 = capCNodePtr (capability.ThreadCap x1) \<and> x112 = capCNodeBits (capability.ThreadCap x1) else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = x1 else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = x1 else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap capability.NullCap then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr capability.NullCap else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap capability.NullCap then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr capability.NullCap else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap capability.NullCap then x111 = capCNodePtr capability.NullCap \<and> x112 = capCNodeBits capability.NullCap else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap capability.NullCap then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr capability.NullCap else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap capability.NullCap then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr capability.NullCap else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = x31 else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then x111 = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> x112 = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.IRQHandlerCap x4) then x111 = capCNodePtr (capability.IRQHandlerCap x4) \<and> x112 = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = x51 else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then x111 = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> x112 = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap capability.DomainCap then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr capability.DomainCap else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap capability.DomainCap then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr capability.DomainCap else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap capability.DomainCap then x111 = capCNodePtr capability.DomainCap \<and> x112 = capCNodeBits capability.DomainCap else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap capability.DomainCap then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr capability.DomainCap else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap capability.DomainCap then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr capability.DomainCap else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.Zombie x71 x72 x73) then x111 = capCNodePtr (capability.Zombie x71 x72 x73) \<and> x112 = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.ArchObjectCap x8) then x111 = capCNodePtr (capability.ArchObjectCap x8) \<and> x112 = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then x111 = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> x112 = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = x91 else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = x91 else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then x111 = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> x112 = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111a x112a x113a x114a. cap' = capability.CNodeCap x111a x112a x113a x114a \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap (capability.CNodeCap x111a x112a x113a x114a) then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr (capability.CNodeCap x111a x112a x113a x114a) else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap (capability.CNodeCap x111a x112a x113a x114a) then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr (capability.CNodeCap x111a x112a x113a x114a) else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap (capability.CNodeCap x111a x112a x113a x114a) then x111 = x111a \<and> x112 = x112a else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap (capability.CNodeCap x111a x112a x113a x114a) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.CNodeCap x111a x112a x113a x114a) else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap (capability.CNodeCap x111a x112a x113a x114a) then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr (capability.CNodeCap x111a x112a x113a x114a) else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap (capability.CNodeCap x111a x112a x113a x114a) then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.CNodeCap x111a x112a x113a x114a) then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap (capability.CNodeCap x111a x112a x113a x114a) then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap (capability.CNodeCap x111a x112a x113a x114a) then undefined else False) = (x111 = x111a \<and> x112 = x112a \<and> \<not> isZombie (capability.CNodeCap x111a x112a 0 0) \<and> \<not> isUntypedCap (capability.CNodeCap x111a x112a 0 0) \<or> capRange (capability.CNodeCap x111a x112a 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111a x112a 0 0) \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap (capability.CNodeCap x111a x112a 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap (capability.CNodeCap x111 x112 x113 x114) \<and> isEndpointCap capability.IRQControlCap then capEPPtr (capability.CNodeCap x111 x112 x113 x114) = capEPPtr capability.IRQControlCap else if isNotificationCap (capability.CNodeCap x111 x112 x113 x114) \<and> isNotificationCap capability.IRQControlCap then capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) = capNtfnPtr capability.IRQControlCap else if isCNodeCap (capability.CNodeCap x111 x112 x113 x114) \<and> isCNodeCap capability.IRQControlCap then x111 = capCNodePtr capability.IRQControlCap \<and> x112 = capCNodeBits capability.IRQControlCap else if isThreadCap (capability.CNodeCap x111 x112 x113 x114) \<and> isThreadCap capability.IRQControlCap then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr capability.IRQControlCap else if isReplyCap (capability.CNodeCap x111 x112 x113 x114) \<and> isReplyCap capability.IRQControlCap then capTCBPtr (capability.CNodeCap x111 x112 x113 x114) = capTCBPtr capability.IRQControlCap else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQControlCap capability.IRQControlCap then True else if isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap capability.IRQControlCap then True else if isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) \<and> isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) \<and> isArchObjectCap capability.IRQControlCap then undefined else False) = (capRange capability.IRQControlCap \<noteq> {} \<and> capRange capability.IRQControlCap \<subseteq> capRange (capability.CNodeCap x111 x112 0 0) \<and> isUntypedCap (capability.CNodeCap x111 x112 0 0) \<or> isIRQControlCap (capability.CNodeCap x111 x112 0 0) \<and> isIRQHandlerCap capability.IRQControlCap))) \<and> (cap = capability.IRQControlCap \<longrightarrow> (\<forall>x1. cap' = capability.ThreadCap x1 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.ThreadCap x1) then capEPPtr capability.IRQControlCap = capEPPtr (capability.ThreadCap x1) else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.ThreadCap x1) then capNtfnPtr capability.IRQControlCap = capNtfnPtr (capability.ThreadCap x1) else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.ThreadCap x1) then capCNodePtr capability.IRQControlCap = capCNodePtr (capability.ThreadCap x1) \<and> capCNodeBits capability.IRQControlCap = capCNodeBits (capability.ThreadCap x1) else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.ThreadCap x1) then capTCBPtr capability.IRQControlCap = x1 else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.ThreadCap x1) then capTCBPtr capability.IRQControlCap = x1 else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.ThreadCap x1) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ThreadCap x1) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ThreadCap x1) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.ThreadCap x1) then undefined else False) = (capRange (capability.ThreadCap x1) \<noteq> {} \<and> capRange (capability.ThreadCap x1) \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ThreadCap x1))) \<and> (cap' = capability.NullCap \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap capability.NullCap then capEPPtr capability.IRQControlCap = capEPPtr capability.NullCap else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap capability.NullCap then capNtfnPtr capability.IRQControlCap = capNtfnPtr capability.NullCap else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap capability.NullCap then capCNodePtr capability.IRQControlCap = capCNodePtr capability.NullCap \<and> capCNodeBits capability.IRQControlCap = capCNodeBits capability.NullCap else if isThreadCap capability.IRQControlCap \<and> isThreadCap capability.NullCap then capTCBPtr capability.IRQControlCap = capTCBPtr capability.NullCap else if isReplyCap capability.IRQControlCap \<and> isReplyCap capability.NullCap then capTCBPtr capability.IRQControlCap = capTCBPtr capability.NullCap else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap capability.NullCap then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap capability.NullCap then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap capability.NullCap then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap capability.NullCap then undefined else False) = (capRange capability.NullCap \<noteq> {} \<and> capRange capability.NullCap \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap capability.NullCap)) \<and> (\<forall>x31 x32 x33 x34. cap' = capability.NotificationCap x31 x32 x33 x34 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.NotificationCap x31 x32 x33 x34) then capEPPtr capability.IRQControlCap = capEPPtr (capability.NotificationCap x31 x32 x33 x34) else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.NotificationCap x31 x32 x33 x34) then capNtfnPtr capability.IRQControlCap = x31 else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.NotificationCap x31 x32 x33 x34) then capCNodePtr capability.IRQControlCap = capCNodePtr (capability.NotificationCap x31 x32 x33 x34) \<and> capCNodeBits capability.IRQControlCap = capCNodeBits (capability.NotificationCap x31 x32 x33 x34) else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.NotificationCap x31 x32 x33 x34) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.NotificationCap x31 x32 x33 x34) else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.NotificationCap x31 x32 x33 x34) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.NotificationCap x31 x32 x33 x34) then undefined else False) = (capRange (capability.NotificationCap x31 0 True True) \<noteq> {} \<and> capRange (capability.NotificationCap x31 0 True True) \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.NotificationCap x31 0 True True))) \<and> (\<forall>x4. cap' = capability.IRQHandlerCap x4 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.IRQHandlerCap x4) then capEPPtr capability.IRQControlCap = capEPPtr (capability.IRQHandlerCap x4) else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.IRQHandlerCap x4) then capNtfnPtr capability.IRQControlCap = capNtfnPtr (capability.IRQHandlerCap x4) else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.IRQHandlerCap x4) then capCNodePtr capability.IRQControlCap = capCNodePtr (capability.IRQHandlerCap x4) \<and> capCNodeBits capability.IRQControlCap = capCNodeBits (capability.IRQHandlerCap x4) else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.IRQHandlerCap x4) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.IRQHandlerCap x4) else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.IRQHandlerCap x4) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.IRQHandlerCap x4) else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.IRQHandlerCap x4) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.IRQHandlerCap x4) then undefined else False) = (capRange (capability.IRQHandlerCap x4) \<noteq> {} \<and> capRange (capability.IRQHandlerCap x4) \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.IRQHandlerCap x4))) \<and> (\<forall>x51 x52 x53 x54 x55 x56. cap' = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capEPPtr capability.IRQControlCap = x51 else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capNtfnPtr capability.IRQControlCap = capNtfnPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capCNodePtr capability.IRQControlCap = capCNodePtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> capCNodeBits capability.IRQControlCap = capCNodeBits (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.EndpointCap x51 x52 x53 x54 x55 x56) else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.EndpointCap x51 x52 x53 x54 x55 x56) then undefined else False) = (capRange (capability.EndpointCap x51 0 True True True True) \<noteq> {} \<and> capRange (capability.EndpointCap x51 0 True True True True) \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.EndpointCap x51 0 True True True True))) \<and> (cap' = capability.DomainCap \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap capability.DomainCap then capEPPtr capability.IRQControlCap = capEPPtr capability.DomainCap else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap capability.DomainCap then capNtfnPtr capability.IRQControlCap = capNtfnPtr capability.DomainCap else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap capability.DomainCap then capCNodePtr capability.IRQControlCap = capCNodePtr capability.DomainCap \<and> capCNodeBits capability.IRQControlCap = capCNodeBits capability.DomainCap else if isThreadCap capability.IRQControlCap \<and> isThreadCap capability.DomainCap then capTCBPtr capability.IRQControlCap = capTCBPtr capability.DomainCap else if isReplyCap capability.IRQControlCap \<and> isReplyCap capability.DomainCap then capTCBPtr capability.IRQControlCap = capTCBPtr capability.DomainCap else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap capability.DomainCap then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap capability.DomainCap then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap capability.DomainCap then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap capability.DomainCap then undefined else False) = (capRange capability.DomainCap \<noteq> {} \<and> capRange capability.DomainCap \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap capability.DomainCap)) \<and> (\<forall>x71 x72 x73. cap' = capability.Zombie x71 x72 x73 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.Zombie x71 x72 x73) then capEPPtr capability.IRQControlCap = capEPPtr (capability.Zombie x71 x72 x73) else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.Zombie x71 x72 x73) then capNtfnPtr capability.IRQControlCap = capNtfnPtr (capability.Zombie x71 x72 x73) else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.Zombie x71 x72 x73) then capCNodePtr capability.IRQControlCap = capCNodePtr (capability.Zombie x71 x72 x73) \<and> capCNodeBits capability.IRQControlCap = capCNodeBits (capability.Zombie x71 x72 x73) else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.Zombie x71 x72 x73) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.Zombie x71 x72 x73) else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.Zombie x71 x72 x73) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.Zombie x71 x72 x73) else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.Zombie x71 x72 x73) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.Zombie x71 x72 x73) then undefined else False) = (capRange (capability.Zombie x71 x72 x73) \<noteq> {} \<and> capRange (capability.Zombie x71 x72 x73) \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.Zombie x71 x72 x73))) \<and> (\<forall>x8. cap' = capability.ArchObjectCap x8 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.ArchObjectCap x8) then capEPPtr capability.IRQControlCap = capEPPtr (capability.ArchObjectCap x8) else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.ArchObjectCap x8) then capNtfnPtr capability.IRQControlCap = capNtfnPtr (capability.ArchObjectCap x8) else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.ArchObjectCap x8) then capCNodePtr capability.IRQControlCap = capCNodePtr (capability.ArchObjectCap x8) \<and> capCNodeBits capability.IRQControlCap = capCNodeBits (capability.ArchObjectCap x8) else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.ArchObjectCap x8) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.ArchObjectCap x8) else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.ArchObjectCap x8) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.ArchObjectCap x8) else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.ArchObjectCap x8) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ArchObjectCap x8) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.ArchObjectCap x8) then undefined else False) = (capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)) \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ArchObjectCap (case x8 of arch_capability.ASIDPoolCap pool asid \<Rightarrow> arch_capability.ASIDPoolCap pool 0 | arch_capability.ASIDControlCap \<Rightarrow> x8 | arch_capability.PageCap d ref rghts sz mapdata \<Rightarrow> arch_capability.PageCap d ref VMReadWrite sz None | arch_capability.PageTableCap ptr data \<Rightarrow> arch_capability.PageTableCap ptr None | arch_capability.PageDirectoryCap ptr data \<Rightarrow> arch_capability.PageDirectoryCap ptr None)))) \<and> (\<forall>x91 x92 x93. cap' = capability.ReplyCap x91 x92 x93 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.ReplyCap x91 x92 x93) then capEPPtr capability.IRQControlCap = capEPPtr (capability.ReplyCap x91 x92 x93) else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.ReplyCap x91 x92 x93) then capNtfnPtr capability.IRQControlCap = capNtfnPtr (capability.ReplyCap x91 x92 x93) else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.ReplyCap x91 x92 x93) then capCNodePtr capability.IRQControlCap = capCNodePtr (capability.ReplyCap x91 x92 x93) \<and> capCNodeBits capability.IRQControlCap = capCNodeBits (capability.ReplyCap x91 x92 x93) else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.ReplyCap x91 x92 x93) then capTCBPtr capability.IRQControlCap = x91 else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.ReplyCap x91 x92 x93) then capTCBPtr capability.IRQControlCap = x91 else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.ReplyCap x91 x92 x93) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ReplyCap x91 x92 x93) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.ReplyCap x91 x92 x93) then undefined else False) = (capRange (capability.ReplyCap x91 True True) \<noteq> {} \<and> capRange (capability.ReplyCap x91 True True) \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.ReplyCap x91 True True))) \<and> (\<forall>x101 x102 x103 x104. cap' = capability.UntypedCap x101 x102 x103 x104 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.UntypedCap x101 x102 x103 x104) then capEPPtr capability.IRQControlCap = capEPPtr (capability.UntypedCap x101 x102 x103 x104) else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.UntypedCap x101 x102 x103 x104) then capNtfnPtr capability.IRQControlCap = capNtfnPtr (capability.UntypedCap x101 x102 x103 x104) else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.UntypedCap x101 x102 x103 x104) then capCNodePtr capability.IRQControlCap = capCNodePtr (capability.UntypedCap x101 x102 x103 x104) \<and> capCNodeBits capability.IRQControlCap = capCNodeBits (capability.UntypedCap x101 x102 x103 x104) else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.UntypedCap x101 x102 x103 x104) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.UntypedCap x101 x102 x103 x104) else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 x104) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.UntypedCap x101 x102 x103 x104) then undefined else False) = (x102 \<le> x102 + 2 ^ x103 - 1 \<and> {x102..x102 + 2 ^ x103 - 1} \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.UntypedCap x101 x102 x103 0))) \<and> (\<forall>x111 x112 x113 x114. cap' = capability.CNodeCap x111 x112 x113 x114 \<longrightarrow> (if isEndpointCap capability.IRQControlCap \<and> isEndpointCap (capability.CNodeCap x111 x112 x113 x114) then capEPPtr capability.IRQControlCap = capEPPtr (capability.CNodeCap x111 x112 x113 x114) else if isNotificationCap capability.IRQControlCap \<and> isNotificationCap (capability.CNodeCap x111 x112 x113 x114) then capNtfnPtr capability.IRQControlCap = capNtfnPtr (capability.CNodeCap x111 x112 x113 x114) else if isCNodeCap capability.IRQControlCap \<and> isCNodeCap (capability.CNodeCap x111 x112 x113 x114) then capCNodePtr capability.IRQControlCap = x111 \<and> capCNodeBits capability.IRQControlCap = x112 else if isThreadCap capability.IRQControlCap \<and> isThreadCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isReplyCap capability.IRQControlCap \<and> isReplyCap (capability.CNodeCap x111 x112 x113 x114) then capTCBPtr capability.IRQControlCap = capTCBPtr (capability.CNodeCap x111 x112 x113 x114) else if isIRQControlCap capability.IRQControlCap \<and> isIRQControlCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then True else if isIRQHandlerCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 x113 x114) then undefined else if isArchObjectCap capability.IRQControlCap \<and> isArchObjectCap (capability.CNodeCap x111 x112 x113 x114) then undefined else False) = (capRange (capability.CNodeCap x111 x112 0 0) \<noteq> {} \<and> capRange (capability.CNodeCap x111 x112 0 0) \<subseteq> capRange capability.IRQControlCap \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap (capability.CNodeCap x111 x112 0 0))) \<and> (cap' = capability.IRQControlCap \<longrightarrow> (if isEndpointCap capability.IRQControlCap then True else if isNotificationCap capability.IRQControlCap then True else if isCNodeCap capability.IRQControlCap then True else if isThreadCap capability.IRQControlCap then True else if isReplyCap capability.IRQControlCap then True else if isIRQControlCap capability.IRQControlCap then True else if isIRQHandlerCap capability.IRQControlCap then undefined else if isArchObjectCap capability.IRQControlCap then undefined else False) = (\<not> isZombie capability.IRQControlCap \<and> \<not> isUntypedCap capability.IRQControlCap \<or> capRange capability.IRQControlCap \<noteq> {} \<and> isUntypedCap capability.IRQControlCap \<or> isIRQControlCap capability.IRQControlCap \<and> isIRQHandlerCap capability.IRQControlCap))) proof (prove)
goal (1 subgoal):
 1. \<forall>d v0 v1 f. cap \<noteq> capability.UntypedCap d v0 v1 f \<Longrightarrow> \<forall>x31 x32 x33 x34. (\<exists>x35. cap = capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<longrightarrow> (\<forall>x31a x32a x33 x34a. (\<exists>x35. cap' = capability.ArchObjectCap (arch_capability.PageCap x31a x32a x33 x34a x35)) \<longrightarrow> (let topB = x32a + 2 ^ pageBitsForSize x34a - 1 in x32 \<le> x32a \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> x32a \<le> topB) = (capRange (capability.ArchObjectCap (arch_capability.PageCap x31a x32a VMReadWrite x34a None)) \<noteq> {} \<and> capRange (capability.ArchObjectCap (arch_capability.PageCap x31a x32a VMReadWrite x34a None)) \<subseteq> capRange (capability.ArchObjectCap (arch_capability.PageCap x31 x32 VMReadWrite x34 None)))) proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32 x33 x34 x35 x31a x32a x33a x34a x35a. \<lbrakk>cap = capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35); cap' = capability.ArchObjectCap (arch_capability.PageCap x31a x32a x33a x34a x35a)\<rbrakk> \<Longrightarrow> (x32 \<le> x32a \<and> x32a + 2 ^ pageBitsForSize x34a - 1 \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> x32a \<le> x32a + 2 ^ pageBitsForSize x34a - 1) = (x32a \<le> x32a + 2 ^ pageBitsForSize x34a - 1 \<and> (x32a \<le> x32a + 2 ^ pageBitsForSize x34a - 1 \<longrightarrow> x32 \<le> x32a \<and> x32a + 2 ^ pageBitsForSize x34a - 1 \<le> x32 + 2 ^ pageBitsForSize x34 - 1)) proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32 x33 x34 x35 x31a x32a x33a x34a x35a. \<lbrakk>cap = capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35); cap' = capability.ArchObjectCap (arch_capability.PageCap x31a x32a x33a x34a x35a)\<rbrakk> \<Longrightarrow> (x32 \<le> x32a \<and> x32a + 2 ^ pageBitsForSize x34a - 1 \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> x32a \<le> x32a + 2 ^ pageBitsForSize x34a - 1) = (x32a \<le> x32a + 2 ^ pageBitsForSize x34a - 1 \<and> x32 \<le> x32a \<and> x32a + 2 ^ pageBitsForSize x34a - 1 \<le> x32 + 2 ^ pageBitsForSize x34 - 1)