theory Detype_R

lemma createObjects_Cons:
  "\<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n));
    pspace_distinct' s;pspace_aligned' s;
    pspace_no_overlap' ptr sz s;pspace_aligned' s; ptr \<noteq> 0\<rbrakk>
   \<Longrightarrow> createObjects' ptr (Suc (Suc n)) val us s =
       (do createObjects' ptr (Suc n) val us;
           createObjects' (((1 + of_nat n) << (objBitsKO val + us)) + ptr)
                          (Suc 0) val us
        od) s" supply option.case_cong_weak [cong] subst_all [simp del] apply (clarsimp simp:createObjects'_def split_def bind_assoc) apply (subgoal_tac "is_aligned (((1::word32) + of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)") prefer 2 apply (clarsimp simp:field_simps) apply (rule aligned_add_aligned[OF range_cover.aligned],assumption) apply (rule is_aligned_shiftl_self) apply (simp add:range_cover_def) apply (rule monad_eq_split[where Q ="\<lambda>x s'. s' = s \<and> ptr && mask (objBitsKO val + us) = 0"]) apply (clarsimp simp:is_aligned_mask[symmetric]) apply (subst new_cap_addrs_fold') apply (drule range_cover_not_zero_shift[rotated,where gbits = us]) apply simp+ apply (simp add:word_le_sub1) apply (subst new_cap_addrs_fold') apply (drule range_cover_le[where n = "Suc n"]) apply simp apply (drule range_cover_not_zero_shift[rotated,where gbits = us]) apply simp+ apply (simp add:word_le_sub1) apply (subst new_cap_addrs_fold') apply (rule word_1_le_power) apply (simp add:range_cover_def) apply (rule monad_eq_split[where Q ="\<lambda>r s'. r = ksPSpace s \<and> s' = s"]) apply (rule monad_eq_split2[where Q = "\<lambda>r s'. s' = s"]) apply (simp add:field_simps) apply (subst no_overlap_check) apply (erule range_cover_le) apply simp+ apply (subst no_overlap_check) apply (erule range_cover_le) apply simp+ apply clarsimp apply (simp add:new_caps_addrs_append[where n = "Suc n",simplified]) apply (subst modify_specify2[where g = return,simplified]) apply (subst modify_specify2) apply (subst modify_specify) apply (simp add:modify_comp) apply (subst monad_commute_simple[OF modify_objs_commute,where g= "\<lambda>x y. return ()",simplified]) apply (frule range_cover.sz(1)) apply (frule range_cover.sz(2)) apply clarsimp apply (erule new_cap_addrs_disjoint) apply (rule monad_eq_split2[where Q =
           "\<lambda>r. pspace_no_overlap' (((1::word32) + of_nat n << objBitsKO val + us) + ptr)
                                   (objBitsKO val + us) and pspace_aligned'"]) apply (simp add:shiftl_t2n field_simps) apply (clarsimp simp:unless_True) apply (rule sym) apply (clarsimp simp:gets_def get_def) apply (subst bind_def,simp) apply (subst monad_eq) apply (rule no_overlap_check) apply (erule range_cover_full) apply (simp add:range_cover_def word_bits_def) apply (simp add:field_simps) apply simp+ apply (clarsimp simp:simpler_modify_def) apply wp apply (clarsimp simp del:fun_upd_apply) apply (rule conjI) apply (rule use_valid[OF _ pspace_no_overlap'_modify[where sz = sz]]) apply (simp add:simpler_modify_def) apply (clarsimp simp:field_simps) apply (rule pspace_no_overlap'_le) apply (erule pspace_no_overlap'_tail) apply simp+ apply (simp add:range_cover_def) apply (erule range_cover.sz(1)[where 'a=32, folded word_bits_def]) apply (subst data_map_insert_def[symmetric]) apply (drule(2) retype_aligned_distinct'(2)) prefer 2 apply (simp cong: kernel_state.fold_congs) apply (drule range_cover_le[where n = "Suc n"]) apply simp apply (rule range_cover_le[OF range_cover_rel,OF _ _ _ le_refl]) apply simp+ apply (drule range_cover.unat_of_nat_n_shift[where gbits = us]) apply simp apply simp apply (wp haskell_assert_wp | wpc)+ apply simp apply (wp unless_wp |clarsimp)+ apply (drule range_cover.aligned) apply (simp add:is_aligned_mask) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_aligned' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> createObjects' ptr (Suc (Suc n)) val us s = (do createObjects' ptr (Suc n) val us;
createObjects' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (Suc 0) val us
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_aligned' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> createObjects' ptr (Suc (Suc n)) val us s = (do createObjects' ptr (Suc n) val us;
createObjects' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (Suc 0) val us
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> (do y <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) s = (do x <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
y <- unless ((1 + word_of_nat n << objBitsKO val + us) + ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) s = (do x <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
y <- unless ((1 + word_of_nat n << objBitsKO val + us) + ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) s = (do x <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
y <- unless ((1 + word_of_nat n << objBitsKO val + us) + ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val)
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) s = (do x <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
y <- unless ((1 + word_of_nat n << objBitsKO val + us) + ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned (1 + word_of_nat n << us + objBitsKO val) (us + objBitsKO val)
 2. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> us + objBitsKO val \<le> us + objBitsKO val
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) s = (do x <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
y <- unless ((1 + word_of_nat n << objBitsKO val + us) + ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0\<rbrakk> \<Longrightarrow> us + objBitsKO val \<le> us + objBitsKO val
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) s = (do x <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
y <- unless ((1 + word_of_nat n << objBitsKO val + us) + ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) s = (do x <- unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
y <- unless ((1 + word_of_nat n << objBitsKO val + us) + ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s proof (prove)
goal (3 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) sa = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
y <- unless ((1 + word_of_nat n << objBitsKO val + us) + ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) sa
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (2 + word_of_nat n << us) - 1]) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (4 subgoals):
 1. \<And>_ y ps. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> 1 \<le> 2 + word_of_nat n << us
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (6 subgoals):
 1. \<And>_ y ps. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> us \<le> objBitsKO val + us
 2. \<And>_ y ps. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> Suc (Suc n) \<noteq> 0
 3. \<And>_ y ps. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); word_of_nat (Suc (Suc n)) << us \<noteq> 0\<rbrakk> \<Longrightarrow> 1 \<le> 2 + word_of_nat n << us
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); 2 + word_of_nat n << us \<noteq> 0\<rbrakk> \<Longrightarrow> 1 \<le> 2 + word_of_nat n << us
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>n. ptr + (n << objBitsKO val)) [0 .e. (1 + word_of_nat n << us) - 1]) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (4 subgoals):
 1. \<And>_ xa x. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> 1 \<le> 1 + word_of_nat n << us
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (5 subgoals):
 1. \<And>_ xa x. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> Suc n \<le> Suc (Suc n)
 2. \<And>_ xa x. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); range_cover ptr sz (objBitsKO val + us) (Suc n)\<rbrakk> \<Longrightarrow> 1 \<le> 1 + word_of_nat n << us
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (4 subgoals):
 1. \<And>_ xa x. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); range_cover ptr sz (objBitsKO val + us) (Suc n)\<rbrakk> \<Longrightarrow> 1 \<le> 1 + word_of_nat n << us
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (6 subgoals):
 1. \<And>_ xa x. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> us \<le> objBitsKO val + us
 2. \<And>_ xa x. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> Suc n \<noteq> 0
 3. \<And>_ xa x. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); word_of_nat (Suc n) << us \<noteq> 0\<rbrakk> \<Longrightarrow> 1 \<le> 1 + word_of_nat n << us
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); 1 + word_of_nat n << us \<noteq> 0\<rbrakk> \<Longrightarrow> 1 \<le> 1 + word_of_nat n << us
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (map (\<lambda>na. (1 + word_of_nat n << objBitsKO val + us) + ptr + (na << objBitsKO val)) [0 .e. 2 ^ us - 1]) ps))
od) s
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (4 subgoals):
 1. \<And>_ ya ps y xa x. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> 1 \<le> 2 ^ us
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (4 subgoals):
 1. \<And>_ ya ps y xa x. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> us < LENGTH(32)
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (3 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) ps))
od) s = (do x <- gets ksPSpace;
xa <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) x) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) x));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (5 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> (do y <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) r))
od) sa = (do x <- case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [];
y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) r));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) sa
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> (case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) []) sa = (case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) []) sa
 2. \<And>r sa ra saa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s; saa = s\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) r)) saa = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) r));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) saa
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> (case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc n) (us + objBitsKO val) - Suc 0)) (ksPSpace s)) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) []) s = (case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (us + objBitsKO val) - Suc 0)) (ksPSpace s)) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) []) s
 2. \<And>r sa ra saa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s; saa = s\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) r)) saa = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) r));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) saa
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (12 subgoals):
 1. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> range_cover ptr (?sz47 r sa) (us + objBitsKO val) (Suc n)
 2. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (?sz47 r sa) s
 3. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> Suc n \<noteq> 0
 5. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> return () s = (case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (us + objBitsKO val) - Suc 0)) (ksPSpace s)) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) []) s
 6. \<And>r sa ra saa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s; saa = s\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) r)) saa = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) r));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) saa
 7. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 8. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>r sa. \<lbrakk>sa = s; pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> Suc n \<le> Suc (Suc n)
 2. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 3. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> Suc n \<noteq> 0
 5. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> return () s = (case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (us + objBitsKO val) - Suc 0)) (ksPSpace s)) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) []) s
 6. \<And>r sa ra saa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s; saa = s\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) r)) saa = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) r));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) saa
 7. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 8. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> return () s = (case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (us + objBitsKO val) - Suc 0)) (ksPSpace s)) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) []) s
 2. \<And>r sa ra saa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s; saa = s\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) r)) saa = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) r));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) saa
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (12 subgoals):
 1. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> range_cover ptr (?sz52 r sa) (us + objBitsKO val) (Suc (Suc n))
 2. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (?sz52 r sa) s
 3. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> Suc (Suc n) \<noteq> 0
 5. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> return () s = return () s
 6. \<And>r sa ra saa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s; saa = s\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) r)) saa = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) r));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) saa
 7. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 8. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>r sa. \<lbrakk>sa = s; pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> Suc (Suc n) \<le> Suc (Suc n)
 2. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 3. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> pspace_aligned' s
 4. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> Suc (Suc n) \<noteq> 0
 5. \<And>r sa. \<lbrakk>sa = s; range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val); r = ksPSpace s\<rbrakk> \<Longrightarrow> return () s = return () s
 6. \<And>r sa ra saa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s; saa = s\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) r)) saa = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) r));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) saa
 7. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 8. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
A total of 12 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>r sa sb. \<lbrakk>sb = s; range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s; sa = s\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) (ksPSpace s))) s = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) (ksPSpace s)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 + word_of_nat n << us)) ptr val) (ksPSpace s))) s = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) (ksPSpace s)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace s)))) s = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) (ksPSpace s)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>a. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) a))) s = (do y <- modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) (ksPSpace s)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>a. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) a))) s = (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>a. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) a))) s = (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val)));
modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)))
od) s = (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> set (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) \<inter> set (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) = {}
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val)))
od) s = (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); sz < LENGTH(32)\<rbrakk> \<Longrightarrow> set (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) \<inter> set (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) = {}
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val)))
od) s = (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); sz < LENGTH(32); objBitsKO val + us \<le> sz\<rbrakk> \<Longrightarrow> set (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) \<inter> set (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) = {}
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val)))
od) s = (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); sz < 32; objBitsKO val + us \<le> sz\<rbrakk> \<Longrightarrow> set (new_cap_addrs (2 ^ us) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) \<inter> set (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val) = {}
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val)))
od) s = (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val)))
od) s = (do y <- modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (10 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) s = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) s
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); (pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned') sa\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa = (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) sa
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 6. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (9 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); (pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned') sa\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa = (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) sa
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (9 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa = (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) sa
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (9 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (do ps <- gets ksPSpace;
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) ps) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>psa. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) ps))
od) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (9 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (do s <- \<lambda>s. ({(s, s)}, False);
y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) (ksPSpace s)) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>ps. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace s)))
od) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (9 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (do y <- case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) (ksPSpace sa)) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) [];
modify (ksPSpace_update (\<lambda>ps. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace sa)))
od) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (10 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (case fst (lookupAround2 ((1 + word_of_nat n << objBitsKO val + us) + ptr + word_of_nat (shiftL (Suc 0) (objBitsKO val + us) - Suc 0)) (ksPSpace sa)) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ((1 + word_of_nat n << objBitsKO val + us) + ptr)) []) sa = ?b92 sa sa
 2. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (do y <- ?b92 sa;
modify (ksPSpace_update (\<lambda>ps. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace sa)))
od) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 6. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (13 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> range_cover ((1 + word_of_nat n << objBitsKO val + us) + ptr) (?sz94 sa) (objBitsKO val + us) (Suc 0)
 2. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (?sz94 sa) sa
 3. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> pspace_aligned' sa
 4. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> Suc 0 \<noteq> 0
 5. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (do y <- return ();
modify (ksPSpace_update (\<lambda>ps. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace sa)))
od) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 8. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 9. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> objBitsKO val + us < word_bits
 2. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa
 3. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> pspace_aligned' sa
 4. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> Suc 0 \<noteq> 0
 5. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (do y <- return ();
modify (ksPSpace_update (\<lambda>ps. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace sa)))
od) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 8. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 9. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa
 2. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> pspace_aligned' sa
 3. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> Suc 0 \<noteq> 0
 4. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (do y <- return ();
modify (ksPSpace_update (\<lambda>ps. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace sa)))
od) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 7. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 8. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> pspace_aligned' sa
 2. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> Suc 0 \<noteq> 0
 3. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> (do y <- return ();
modify (ksPSpace_update (\<lambda>ps. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace sa)))
od) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 6. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 7. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) sa; pspace_aligned' sa\<rbrakk> \<Longrightarrow> modify (ksPSpace_update (\<lambda>ps. foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val) (ksPSpace sa))) sa = modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (2 ^ us)) ((1 + word_of_nat n << objBitsKO val + us) + ptr) val))) sa
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P76\<rbrace> modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) \<lbrace>\<lambda>r. pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned'\<rbrace>
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P76 s
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) and pspace_aligned') (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s) \<and> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us) (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (9 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (?r111, ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s) \<in> fst (modify (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val))) ?s111)
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (K (range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)) \<and> ptr \<noteq> 0) and pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)) ?s111
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> (K (range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)) \<and> ptr \<noteq> 0) and pspace_no_overlap' ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)) s
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val) s
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (10 subgoals):
 1. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (ptr + (1 + word_of_nat n << us + objBitsKO val)) ?sz119 s
 2. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> us + objBitsKO val \<le> ?sz119
 3. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> ?sz119 < word_bits
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 6. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (13 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> pspace_aligned' s
 2. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 4. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> ptr \<noteq> 0
 5. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> us + objBitsKO val \<le> sz
 6. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> sz < word_bits
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 8. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 9. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 10. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (9 subgoals):
 1. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> us + objBitsKO val \<le> sz
 2. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> sz < word_bits
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (us + objBitsKO val) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned (ptr + (1 + word_of_nat n << us + objBitsKO val)) (us + objBitsKO val); is_aligned ptr (us + objBitsKO val)\<rbrakk> \<Longrightarrow> sz < word_bits
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr map. map(addr \<mapsto> val)) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr. data_map_insert addr val) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> range_cover ptr sz (objBitsKO ?ko131) ?n131
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr ?ko131) (new_cap_addrs ?n131 ptr ?ko131) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr. data_map_insert addr val) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr ?ko131) (new_cap_addrs ?n131 ptr ?ko131) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> pspace_aligned' (ksPSpace_update (foldr (\<lambda>addr. data_map_insert addr val) (new_cap_addrs (unat (1 + word_of_nat n << us)) ptr val)) s)
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> range_cover ptr sz (objBitsKO ?ko131) ?n131
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> range_cover ptr sz (objBitsKO val) (unat (1 + word_of_nat n << us))
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> Suc n \<le> Suc (Suc n)
 2. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); range_cover ptr sz (objBitsKO val + us) (Suc n)\<rbrakk> \<Longrightarrow> range_cover ptr sz (objBitsKO val) (unat (1 + word_of_nat n << us))
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); range_cover ptr sz (objBitsKO val + us) (Suc n)\<rbrakk> \<Longrightarrow> range_cover ptr sz (objBitsKO val) (unat (1 + word_of_nat n << us))
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (9 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); range_cover ptr sz (objBitsKO val + us) (Suc n)\<rbrakk> \<Longrightarrow> range_cover ptr sz ?sbit140 ?n140
 2. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); range_cover ptr sz (objBitsKO val + us) (Suc n)\<rbrakk> \<Longrightarrow> objBitsKO val \<le> ?sbit140
 3. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); range_cover ptr sz (objBitsKO val + us) (Suc n)\<rbrakk> \<Longrightarrow> unat (1 + word_of_nat n << us) = 2 ^ (?sbit140 - objBitsKO val) * ?n140
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 5. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 9. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); range_cover ptr sz (objBitsKO val + us) (Suc n)\<rbrakk> \<Longrightarrow> unat (1 + word_of_nat n << us) = 2 ^ us + 2 ^ us * n
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> us \<le> objBitsKO val + us
 2. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); unat (word_of_nat (Suc n) << us) = Suc n * 2 ^ us\<rbrakk> \<Longrightarrow> unat (1 + word_of_nat n << us) = 2 ^ us + 2 ^ us * n
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 4. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 8. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (7 subgoals):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); unat (word_of_nat (Suc n) << us) = Suc n * 2 ^ us\<rbrakk> \<Longrightarrow> unat (1 + word_of_nat n << us) = 2 ^ us + 2 ^ us * n
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 3. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 7. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (6 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> \<lbrace>?P41 r sa\<rbrace> case fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) of None \<Rightarrow> return () | Some (xa, xaa) \<Rightarrow> haskell_assert (xa < fromPPtr ptr) [] \<lbrace>\<lambda>r sa. sa = s\<rbrace>
 2. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> ?P41 r sa sa
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 6. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (5 subgoals):
 1. \<And>r sa. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us); r = ksPSpace s \<and> sa = s\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) = None \<longrightarrow> sa = s) \<and> (\<forall>x. fst (lookupAround2 (ptr + word_of_nat (shiftL (Suc (Suc n)) (objBitsKO val + us) - Suc 0)) r) = Some x \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> xa < fromPPtr ptr \<longrightarrow> sa = s))
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 5. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (4 subgoals):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P37\<rbrace> gets ksPSpace \<lbrace>\<lambda>r sa. r = ksPSpace s \<and> sa = s\<rbrace>
 2. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P37 s
 3. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> \<lbrace>?P11\<rbrace> unless (ptr && mask (objBitsKO val + us) = 0) (alignError (objBitsKO val + us)) \<lbrace>\<lambda>r sa. sa = s \<and> ptr && mask (objBitsKO val + us) = 0\<rbrace>
 4. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ?P11 s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (objBitsKO val + us) (Suc (Suc n)); pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ptr && mask (objBitsKO val + us) = 0 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_distinct' s; pspace_no_overlap' ptr sz s; pspace_aligned' s; ptr \<noteq> 0; is_aligned ((1 + word_of_nat n << objBitsKO val + us) + ptr) (objBitsKO val + us); is_aligned ptr (objBitsKO val + us)\<rbrakk> \<Longrightarrow> ptr && mask (objBitsKO val + us) = 0 proof (prove)
goal:
No subgoals!