theory Example_Valid_StateH

lemma map_to_ctes_kh0H_simps[simp]:
  "map_to_ctes kh0H (init_irq_node_ptr + (ucast (irq::10 word) << cte_level_bits)) =
                Some (CTE NullCap Null_mdb)"
  "map_to_ctes kh0H irq_cnode_ptr = Some (CTE NullCap Null_mdb)"
  "length x = 10 \<Longrightarrow> map_to_ctes kh0H (Low_cnode_ptr + of_bl x * 0x10) = Low_cte_cte Low_cnode_ptr (Low_cnode_ptr + of_bl x * 0x10)"
  "length x = 10 \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + of_bl x * 0x10) = High_cte_cte High_cnode_ptr (High_cnode_ptr + of_bl x * 0x10)"
  "length x = 10 \<Longrightarrow> map_to_ctes kh0H (Silc_cnode_ptr + of_bl x * 0x10) = Silc_cte_cte Silc_cnode_ptr (Silc_cnode_ptr + of_bl x * 0x10)"
  "map_to_ctes kh0H Low_tcb_ptr = Low_tcb_cte Low_tcb_ptr"
  "map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)"
  "map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)"
  "map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)"
  "map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)"
  "map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr"
  "map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)"
  "map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)"
  "map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)"
  "map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)"
  "map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr"
  "map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)"
  "map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)"
  "map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)"
  "map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40)" supply option.case_cong[cong] if_cong[cong] apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def) apply fastforce apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct not_in_range_cte_None) apply ((clarsimp simp: map_to_ctes_kh0H option_update_range_def cnode_offs_in_range s0_ptrs_aligned kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None,
         ((clarsimp simp: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | clarsimp simp: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1],
            intro conjI,
               (clarsimp,
                drule not_disjointI,
                  (erule offs_in_range | rule offs_in_range),
                 (erule offs_in_range | rule offs_in_range),
                erule notE,
                rule kh0H_dom_sets_distinct
                )+,
          clarsimp split: option.splits)+)[3] apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct not_in_range_cte_None split: option.splits) apply (cut_tac ptr="Low_tcb_ptr" and x="0x10" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="Low_tcb_ptr" and x="0x20" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="Low_tcb_ptr" and x="0x30" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="Low_tcb_ptr" and x="0x40" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct not_in_range_cte_None  split: option.splits) apply (cut_tac ptr="High_tcb_ptr" and x="0x10" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None  split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="High_tcb_ptr" and x="0x20" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None  split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="High_tcb_ptr" and x="0x30" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None  split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="High_tcb_ptr" and x="0x40" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None  split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct not_in_range_cte_None  split: option.splits) apply (cut_tac ptr="idle_tcb_ptr" and x="0x10" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None  split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="idle_tcb_ptr" and x="0x20" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None  split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="idle_tcb_ptr" and x="0x30" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None  split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp apply (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct) apply (cut_tac ptr="idle_tcb_ptr" and x="0x40" in tcb_offs_in_rangeI, simp add: s0_ptr_defs, simp add: s0_ptr_defs) apply (clarsimp simp: map_to_ctes_kh0H option_update_range_def kh0H_dom_distinct kh0H_dom_distinct' not_in_range_cte_None  split: option.splits) apply ((simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None
        | simp add: offs_in_range kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1] apply (intro conjI impI allI) apply (simp add: s0_ptr_defs) apply clarsimp apply (drule not_disjointI,
             rule irq_node_offs_in_range,
            assumption,
           erule notE,
           rule kh0H_dom_sets_distinct) apply (clarsimp simp: kh0H_dom_distinct) apply clarsimp by (drule not_disjointI,
           rule irq_node_offs_in_range,
          assumption,
         erule notE,
         rule kh0H_dom_sets_distinct)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. (((map_to_ctes kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CTE capability.NullCap (MDB 0 0 False False)) &&& map_to_ctes kh0H irq_cnode_ptr = Some (CTE capability.NullCap (MDB 0 0 False False))) &&& (length x = 10 \<Longrightarrow> map_to_ctes kh0H (Low_cnode_ptr + of_bl x * 0x10) = Low_cte_cte Low_cnode_ptr (Low_cnode_ptr + of_bl x * 0x10)) &&& (length x = 10 \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + of_bl x * 0x10) = High_cte_cte High_cnode_ptr (High_cnode_ptr + of_bl x * 0x10)) &&& (length x = 10 \<Longrightarrow> map_to_ctes kh0H (Silc_cnode_ptr + of_bl x * 0x10) = Silc_cte_cte Silc_cnode_ptr (Silc_cnode_ptr + of_bl x * 0x10))) &&& (map_to_ctes kh0H Low_tcb_ptr = Low_tcb_cte Low_tcb_ptr &&& map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)) &&& map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20) &&& map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30) &&& map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)) &&& ((map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr &&& map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)) &&& map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20) &&& map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30) &&& map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)) &&& (map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr &&& map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)) &&& map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20) &&& map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30) &&& map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (1 subgoal):
 1. (((map_to_ctes kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) = Some (CTE capability.NullCap (MDB 0 0 False False)) &&& map_to_ctes kh0H irq_cnode_ptr = Some (CTE capability.NullCap (MDB 0 0 False False))) &&& (length x = 10 \<Longrightarrow> map_to_ctes kh0H (Low_cnode_ptr + of_bl x * 0x10) = Low_cte_cte Low_cnode_ptr (Low_cnode_ptr + of_bl x * 0x10)) &&& (length x = 10 \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + of_bl x * 0x10) = High_cte_cte High_cnode_ptr (High_cnode_ptr + of_bl x * 0x10)) &&& (length x = 10 \<Longrightarrow> map_to_ctes kh0H (Silc_cnode_ptr + of_bl x * 0x10) = Silc_cte_cte Silc_cnode_ptr (Silc_cnode_ptr + of_bl x * 0x10))) &&& (map_to_ctes kh0H Low_tcb_ptr = Low_tcb_cte Low_tcb_ptr &&& map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)) &&& map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20) &&& map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30) &&& map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)) &&& ((map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr &&& map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)) &&& map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20) &&& map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30) &&& map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)) &&& (map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr &&& map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)) &&& map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20) &&& map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30) &&& map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (20 subgoals):
 1. \<forall>irqa. UCAST(10 \<rightarrow> 32) irqa << cte_level_bits \<noteq> UCAST(10 \<rightarrow> 32) irq << cte_level_bits \<Longrightarrow> (case Low_cte_cte Low_cnode_ptr (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case High_cte_cte High_cnode_ptr (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case Low_tcb_cte (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case High_tcb_cte (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case idle_tcb_cte (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2) = Some (CTE capability.NullCap (MDB 0 0 False False))
 2. map_to_ctes kh0H irq_cnode_ptr = Some (CTE capability.NullCap (MDB 0 0 False False))
 3. length x = 10 \<Longrightarrow> map_to_ctes kh0H (Low_cnode_ptr + of_bl x * 0x10) = Low_cte_cte Low_cnode_ptr (Low_cnode_ptr + of_bl x * 0x10)
 4. length x = 10 \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + of_bl x * 0x10) = High_cte_cte High_cnode_ptr (High_cnode_ptr + of_bl x * 0x10)
 5. length x = 10 \<Longrightarrow> map_to_ctes kh0H (Silc_cnode_ptr + of_bl x * 0x10) = Silc_cte_cte Silc_cnode_ptr (Silc_cnode_ptr + of_bl x * 0x10)
 6. map_to_ctes kh0H Low_tcb_ptr = Low_tcb_cte Low_tcb_ptr
 7. map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. map_to_ctes kh0H irq_cnode_ptr = Some (CTE capability.NullCap (MDB 0 0 False False))
 2. length x = 10 \<Longrightarrow> map_to_ctes kh0H (Low_cnode_ptr + of_bl x * 0x10) = Low_cte_cte Low_cnode_ptr (Low_cnode_ptr + of_bl x * 0x10)
 3. length x = 10 \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + of_bl x * 0x10) = High_cte_cte High_cnode_ptr (High_cnode_ptr + of_bl x * 0x10)
 4. length x = 10 \<Longrightarrow> map_to_ctes kh0H (Silc_cnode_ptr + of_bl x * 0x10) = Silc_cte_cte Silc_cnode_ptr (Silc_cnode_ptr + of_bl x * 0x10)
 5. map_to_ctes kh0H Low_tcb_ptr = Low_tcb_cte Low_tcb_ptr
 6. map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 10. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. length x = 10 \<Longrightarrow> map_to_ctes kh0H (Low_cnode_ptr + of_bl x * 0x10) = Low_cte_cte Low_cnode_ptr (Low_cnode_ptr + of_bl x * 0x10)
 2. length x = 10 \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + of_bl x * 0x10) = High_cte_cte High_cnode_ptr (High_cnode_ptr + of_bl x * 0x10)
 3. length x = 10 \<Longrightarrow> map_to_ctes kh0H (Silc_cnode_ptr + of_bl x * 0x10) = Silc_cte_cte Silc_cnode_ptr (Silc_cnode_ptr + of_bl x * 0x10)
 4. map_to_ctes kh0H Low_tcb_ptr = Low_tcb_cte Low_tcb_ptr
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 9. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 10. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
A total of 18 subgoals... proof (prove)
goal (15 subgoals):
 1. map_to_ctes kh0H Low_tcb_ptr = Low_tcb_cte Low_tcb_ptr
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 6. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 7. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (Low_tcb_ptr + 0x10) = Low_tcb_cte (Low_tcb_ptr + 0x10)
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> (idle_tcb_cte (Low_tcb_ptr + 0x10) = None \<longrightarrow> (High_tcb_cte (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10)))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))))) \<and> ((\<exists>x2. High_tcb_cte (Low_tcb_ptr + 0x10) = Some x2) \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))))))) \<and> ((\<exists>x2. idle_tcb_cte (Low_tcb_ptr + 0x10) = Some x2) \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x10) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))))))
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x10) = None \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2 \<longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = None\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = None; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 8. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 9. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = None; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x10
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 7. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 8. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = None; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 7. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 8. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 6. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 7. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x2 irq. \<lbrakk>Low_tcb_ptr + 0x10 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some x2; Low_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (Low_tcb_ptr + 0x20) = Low_tcb_cte (Low_tcb_ptr + 0x20)
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> (idle_tcb_cte (Low_tcb_ptr + 0x20) = None \<longrightarrow> (High_tcb_cte (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20)))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))))) \<and> ((\<exists>x2. High_tcb_cte (Low_tcb_ptr + 0x20) = Some x2) \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))))))) \<and> ((\<exists>x2. idle_tcb_cte (Low_tcb_ptr + 0x20) = Some x2) \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x20) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))))))
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x20) = None \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2 \<longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = None\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = None; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 7. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 8. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = None; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x20
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 6. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 7. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = None; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 6. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 7. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x2 irq. \<lbrakk>Low_tcb_ptr + 0x20 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x20) = Some x2; Low_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 3. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 4. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 8. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (Low_tcb_ptr + 0x30) = Low_tcb_cte (Low_tcb_ptr + 0x30)
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 3. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 4. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 8. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> (idle_tcb_cte (Low_tcb_ptr + 0x30) = None \<longrightarrow> (High_tcb_cte (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30)))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))))) \<and> ((\<exists>x2. High_tcb_cte (Low_tcb_ptr + 0x30) = Some x2) \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))))))) \<and> ((\<exists>x2. idle_tcb_cte (Low_tcb_ptr + 0x30) = Some x2) \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x30) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))))))
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 3. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 4. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 8. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x30) = None \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2 \<longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 3. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 4. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 8. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = None\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = None; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 6. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 7. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = None; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x30
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = None; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 3. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 4. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 8. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 irq. \<lbrakk>Low_tcb_ptr + 0x30 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x30) = Some x2; Low_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 3. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 4. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 8. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 2. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 3. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (Low_tcb_ptr + 0x40) = Low_tcb_cte (Low_tcb_ptr + 0x40)
 2. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 3. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> (idle_tcb_cte (Low_tcb_ptr + 0x40) = None \<longrightarrow> (High_tcb_cte (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2) \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40)))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))))) \<and> ((\<exists>x2. High_tcb_cte (Low_tcb_ptr + 0x40) = Some x2) \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))))))) \<and> ((\<exists>x2. idle_tcb_cte (Low_tcb_ptr + 0x40) = Some x2) \<longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2 \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (Low_tcb_ptr + 0x40) = Some x2a \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))))))
 2. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 3. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr \<Longrightarrow> (Low_tcb_cte (Low_tcb_ptr + 0x40) = None \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40))) \<and> (\<forall>x2. Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2 \<longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 3. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = None\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = None; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 6. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 10. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = None; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> Low_tcb_ptr + 0x40
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>irq. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = None; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 5. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 9. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 4. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 8. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 3. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2 irq. \<lbrakk>Low_tcb_ptr + 0x40 \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte (Low_tcb_ptr + 0x40) = Some x2; Low_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = Low_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 3. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. map_to_ctes kh0H High_tcb_ptr = High_tcb_cte High_tcb_ptr
 2. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 6. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 2. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (High_tcb_ptr + 0x10) = High_tcb_cte (High_tcb_ptr + 0x10)
 2. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> (idle_tcb_cte (High_tcb_ptr + 0x10) = None \<longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x10) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2) \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2) \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = Some x2) \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. Low_tcb_cte (High_tcb_ptr + 0x10) = Some x2) \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10)))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x10) = Some x2 \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x10) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))))))) \<and> ((\<exists>x2. idle_tcb_cte (High_tcb_ptr + 0x10) = Some x2) \<longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x10) = Some x2 \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x10) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x10) = Some x2a \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))))))
 2. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x10) = None \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x10) = Some x2 \<longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (12 subgoals):
 1. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = None\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = None; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 8. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>irq. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = None; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x10
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>irq. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = None; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 6. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. \<And>x2. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. \<And>x2 irq. \<lbrakk>High_tcb_ptr + 0x10 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x10) = Some x2; High_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 2. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (High_tcb_ptr + 0x20) = High_tcb_cte (High_tcb_ptr + 0x20)
 2. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> (idle_tcb_cte (High_tcb_ptr + 0x20) = None \<longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x20) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2) \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2) \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = Some x2) \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. Low_tcb_cte (High_tcb_ptr + 0x20) = Some x2) \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20)))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x20) = Some x2 \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x20) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))))))) \<and> ((\<exists>x2. idle_tcb_cte (High_tcb_ptr + 0x20) = Some x2) \<longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x20) = Some x2 \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x20) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x20) = Some x2a \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))))))
 2. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x20) = None \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x20) = Some x2 \<longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (11 subgoals):
 1. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = None\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = None; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 7. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>irq. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = None; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x20
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 6. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (10 subgoals):
 1. \<And>irq. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = None; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 6. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. \<And>x2. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. \<And>x2 irq. \<lbrakk>High_tcb_ptr + 0x20 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x20) = Some x2; High_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (7 subgoals):
 1. map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 2. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 3. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (7 subgoals):
 1. High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (High_tcb_ptr + 0x30) = High_tcb_cte (High_tcb_ptr + 0x30)
 2. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 3. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (7 subgoals):
 1. High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> (idle_tcb_cte (High_tcb_ptr + 0x30) = None \<longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x30) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2) \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2) \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = Some x2) \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. Low_tcb_cte (High_tcb_ptr + 0x30) = Some x2) \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30)))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x30) = Some x2 \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x30) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))))))) \<and> ((\<exists>x2. idle_tcb_cte (High_tcb_ptr + 0x30) = Some x2) \<longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x30) = Some x2 \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x30) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x30) = Some x2a \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))))))
 2. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 3. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (7 subgoals):
 1. High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x30) = None \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x30) = Some x2 \<longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 3. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = None\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = None; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 6. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 10. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = None; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x30
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = None; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (7 subgoals):
 1. \<And>x2. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 3. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (7 subgoals):
 1. \<And>x2 irq. \<lbrakk>High_tcb_ptr + 0x30 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x30) = Some x2; High_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 3. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 2. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (High_tcb_ptr + 0x40) = High_tcb_cte (High_tcb_ptr + 0x40)
 2. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> (idle_tcb_cte (High_tcb_ptr + 0x40) = None \<longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x40) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2) \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2) \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = Some x2) \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. Low_tcb_cte (High_tcb_ptr + 0x40) = Some x2) \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40)))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x40) = Some x2 \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x40) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))))))) \<and> ((\<exists>x2. idle_tcb_cte (High_tcb_ptr + 0x40) = Some x2) \<longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x40) = Some x2 \<longrightarrow> (Low_tcb_cte (High_tcb_ptr + 0x40) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (High_tcb_ptr + 0x40) = Some x2a \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))))))
 2. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr \<Longrightarrow> (High_tcb_cte (High_tcb_ptr + 0x40) = None \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40))) \<and> (\<forall>x2. High_tcb_cte (High_tcb_ptr + 0x40) = Some x2 \<longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = None\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = None; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 9. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. \<And>irq. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = None; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> High_tcb_ptr + 0x40
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (8 subgoals):
 1. \<And>irq. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = None; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 8. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (7 subgoals):
 1. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. \<And>x2. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. \<And>x2 irq. \<lbrakk>High_tcb_ptr + 0x40 \<in> tcb_offs_range High_tcb_ptr; High_tcb_cte (High_tcb_ptr + 0x40) = Some x2; High_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = High_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (5 subgoals):
 1. map_to_ctes kh0H idle_tcb_ptr = idle_tcb_cte idle_tcb_ptr
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (idle_tcb_ptr + 0x10) = idle_tcb_cte (idle_tcb_ptr + 0x10)
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> (idle_tcb_cte (idle_tcb_ptr + 0x10) = None \<longrightarrow> (High_tcb_cte (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. Low_tcb_cte (idle_tcb_ptr + 0x10) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10)))) \<and> ((\<exists>x2. High_tcb_cte (idle_tcb_ptr + 0x10) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10)))) \<and> (\<forall>x2. idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2 \<longrightarrow> (High_tcb_cte (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))))) \<and> (\<forall>x2a. High_tcb_cte (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x10) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10) \<longrightarrow> x2a = x2))))))))
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> (idle_tcb_cte (idle_tcb_ptr + 0x10) = None \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10))) \<and> (\<forall>x2. idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2 \<longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = None\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = None; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 7. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = None; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x10
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = None; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (5 subgoals):
 1. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. \<And>x2 irq. \<lbrakk>idle_tcb_ptr + 0x10 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x10) = Some x2; idle_tcb_ptr + 0x10 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (3 subgoals):
 1. map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (3 subgoals):
 1. idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (idle_tcb_ptr + 0x20) = idle_tcb_cte (idle_tcb_ptr + 0x20)
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (3 subgoals):
 1. idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> (idle_tcb_cte (idle_tcb_ptr + 0x20) = None \<longrightarrow> (High_tcb_cte (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. Low_tcb_cte (idle_tcb_ptr + 0x20) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20)))) \<and> ((\<exists>x2. High_tcb_cte (idle_tcb_ptr + 0x20) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20)))) \<and> (\<forall>x2. idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2 \<longrightarrow> (High_tcb_cte (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))))) \<and> (\<forall>x2a. High_tcb_cte (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x20) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20) \<longrightarrow> x2a = x2))))))))
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (3 subgoals):
 1. idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> (idle_tcb_cte (idle_tcb_ptr + 0x20) = None \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20))) \<and> (\<forall>x2. idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2 \<longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = None\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = None; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 6. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (5 subgoals):
 1. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = None; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x20
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (5 subgoals):
 1. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = None; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (3 subgoals):
 1. \<And>x2 irq. \<lbrakk>idle_tcb_ptr + 0x20 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x20) = Some x2; idle_tcb_ptr + 0x20 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (2 subgoals):
 1. map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (2 subgoals):
 1. idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (idle_tcb_ptr + 0x30) = idle_tcb_cte (idle_tcb_ptr + 0x30)
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (2 subgoals):
 1. idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> (idle_tcb_cte (idle_tcb_ptr + 0x30) = None \<longrightarrow> (High_tcb_cte (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. Low_tcb_cte (idle_tcb_ptr + 0x30) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30)))) \<and> ((\<exists>x2. High_tcb_cte (idle_tcb_ptr + 0x30) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30)))) \<and> (\<forall>x2. idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2 \<longrightarrow> (High_tcb_cte (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))))) \<and> (\<forall>x2a. High_tcb_cte (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x30) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30) \<longrightarrow> x2a = x2))))))))
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (2 subgoals):
 1. idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> (idle_tcb_cte (idle_tcb_ptr + 0x30) = None \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30))) \<and> (\<forall>x2. idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2 \<longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2))
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = None\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = None; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 5. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = None; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x30
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (4 subgoals):
 1. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = None; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 4. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (3 subgoals):
 1. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 3. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (2 subgoals):
 1. \<And>x2 irq. \<lbrakk>idle_tcb_ptr + 0x30 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x30) = Some x2; idle_tcb_ptr + 0x30 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x30\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2
 2. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (1 subgoal):
 1. map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (1 subgoal):
 1. idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> map_to_ctes kh0H (idle_tcb_ptr + 0x40) = idle_tcb_cte (idle_tcb_ptr + 0x40) proof (prove)
goal (1 subgoal):
 1. idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> (idle_tcb_cte (idle_tcb_ptr + 0x40) = None \<longrightarrow> (High_tcb_cte (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40))) \<and> ((\<exists>x2. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. Low_tcb_cte (idle_tcb_ptr + 0x40) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40)))) \<and> ((\<exists>x2. High_tcb_cte (idle_tcb_ptr + 0x40) = Some x2) \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<and> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40)))) \<and> (\<forall>x2. idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2 \<longrightarrow> (High_tcb_cte (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))))) \<and> (\<forall>x2a. High_tcb_cte (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_tcb_cte (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))))) \<and> (\<forall>x2a. Low_tcb_cte (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))))) \<and> (\<forall>x2a. Silc_cte_cte Silc_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))) \<and> (\<forall>x2a. High_cte_cte High_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> (Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2a. Low_cte_cte Low_cnode_ptr (idle_tcb_ptr + 0x40) = Some x2a \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40) \<longrightarrow> x2a = x2)))))))) proof (prove)
goal (1 subgoal):
 1. idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr \<Longrightarrow> (idle_tcb_cte (idle_tcb_ptr + 0x40) = None \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40))) \<and> (\<forall>x2. idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2 \<longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<and> (idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr \<longrightarrow> (\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40) \<longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2)) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = None\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 2. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = None; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 4. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2 proof (prove)
goal (3 subgoals):
 1. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = None; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr\<rbrakk> \<Longrightarrow> init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> idle_tcb_ptr + 0x40
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2 proof (prove)
goal (3 subgoals):
 1. \<And>irq. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = None; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> False
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 3. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2 proof (prove)
goal (2 subgoals):
 1. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2\<rbrakk> \<Longrightarrow> idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr
 2. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2 proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2 proof (prove)
goal (1 subgoal):
 1. \<And>x2 irq. \<lbrakk>idle_tcb_ptr + 0x40 \<in> tcb_offs_range idle_tcb_ptr; idle_tcb_cte (idle_tcb_ptr + 0x40) = Some x2; idle_tcb_ptr + 0x40 \<noteq> irq_cnode_ptr; init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = idle_tcb_ptr + 0x40\<rbrakk> \<Longrightarrow> CTE capability.NullCap (MDB 0 0 False False) = x2