theory Untyped_R

lemma mdb_chunked_n' [simp]:
  notes if_cong[cong del] if_weak_cong[cong]
  shows "mdb_chunked n'" using chunked untyped_mdb untyped_inc apply (clarsimp simp: mdb_chunked_def) apply (drule n'_cap)+ apply (simp add: n'_trancl_eq split del: if_split) apply (simp split: if_split_asm) apply clarsimp apply (frule sameRegion_parentI) apply (frule(1) untyped_inc_mdbD [OF _ is_untyped _ _ untyped_inc untyped_mdb no_loops, OF _ parent]) apply (elim disjE) apply (frule sameRegionAs_capRange_Int) apply (simp add: phys) apply (rule valid_capAligned [OF valid_c']) apply (rule valid_capAligned) apply (erule valid_capI') apply (erule notE, erule(1) descendants_rangeD' [OF range, rotated]) apply (clarsimp simp: parent parent_chunk) apply clarsimp apply (frule subtree_mdb_next) apply (simp add: m_loop_trancl_rtrancl [OF trancl_into_rtrancl, where x=parent]) apply (case_tac "p' = parent") apply (clarsimp simp: parent) apply (drule_tac x=p' in spec) apply (drule_tac x=parent in spec) apply (frule sameRegionAs_trans [OF _ same_region]) apply (clarsimp simp: parent is_chunk_def n'_trancl_eq n'_rtrancl_eq
                          m_rtrancl_to_site site' new_site_def) apply (drule_tac x=p'' in spec) apply clarsimp apply (drule_tac p=p'' in m_cap, clarsimp) apply clarsimp apply (erule_tac x=p in allE) apply (erule_tac x=parent in allE) apply (insert parent is_untyped)[1] apply simp apply (case_tac "p = parent") apply (simp add: parent) apply (clarsimp simp add: is_chunk_def) apply (simp add: rtrancl_eq_or_trancl) apply (erule disjE) apply (clarsimp simp: site' new_site_def) apply clarsimp apply (drule tranclD) apply (clarsimp simp: n'_direct_eq) apply (drule (1) transitive_closure_trans) apply simp apply simp apply (case_tac "isUntypedCap cap") prefer 2 apply (simp add: untyped_mdb'_def) apply (erule_tac x=parent in allE) apply simp apply (erule_tac x=p in allE) apply (simp add: descendants_of'_def) apply (drule mp[where P="S \<inter> T \<noteq> {}" for S T]) apply (frule sameRegionAs_capRange_Int, simp add: phys) apply (rule valid_capAligned, erule valid_capI') apply (rule valid_capAligned, rule valid_c') apply (insert capRange_ut)[1] apply blast apply (drule (1) rangeD) apply (drule capRange_sameRegionAs, rule valid_c') apply (simp add: phys) apply simp apply (case_tac "untypedRange parent_cap \<subseteq> untypedRange cap") apply (erule impE) apply (clarsimp simp only: isCap_simps untypedRange.simps) apply (subst (asm) range_subset_eq) apply (drule valid_capI')+ apply (drule valid_capAligned)+ apply (clarsimp simp: capAligned_def) apply (erule is_aligned_no_overflow) apply (simp(no_asm) add: sameRegionAs_def3 isCap_simps) apply (drule valid_capI')+ apply (drule valid_capAligned)+ apply (clarsimp simp: capAligned_def is_aligned_no_overflow) apply clarsimp apply (erule disjE) apply simp apply (rule conjI) prefer 2 apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply (thin_tac "P \<longrightarrow> Q" for P Q) apply (clarsimp simp: is_chunk_def) apply (simp add: n'_trancl_eq n'_rtrancl_eq split: if_split_asm) apply (simp add: site' new_site_def) apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply (simp add: rtrancl_eq_or_trancl) apply simp apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply clarsimp apply (clarsimp simp: is_chunk_def) apply (simp add: n'_trancl_eq n'_rtrancl_eq split: if_split_asm) apply (drule (1) transitive_closure_trans, erule loopE) apply (subgoal_tac "m \<turnstile> p \<rightarrow> parent") apply (drule subtree_mdb_next) apply (drule (1) trancl_trans, erule loopE) apply (thin_tac "All P" for P) apply (drule_tac p=parent and p'=p in untyped_incD'[rotated], assumption+) apply simp apply (subgoal_tac "\<not> m \<turnstile> parent \<rightarrow> p") prefer 2 apply clarsimp apply (drule (1) rangeD) apply (drule capRange_sameRegionAs, rule valid_c') apply (simp add: phys) apply simp apply (clarsimp simp: descendants_of'_def subset_iff_psubset_eq) apply (erule disjE,simp,simp) apply (drule_tac p=parent and p'=p in untyped_incD'[rotated], assumption+) apply (simp add:subset_iff_psubset_eq descendants_of'_def) apply (elim disjE conjE| simp )+ apply (drule(1) rangeD) apply (drule capRange_sameRegionAs[OF _ valid_c']) apply (simp add:phys)+ apply (insert capRange_c' is_untyped)[1] apply (simp add: untypedCapRange [symmetric]) apply (drule(1) disjoint_subset) apply (drule capRange_sameRegionAs[OF _ valid_c']) apply (simp add:phys) apply (simp add:Int_ac) apply clarsimp apply (erule_tac x=p in allE) apply (erule_tac x=p' in allE) apply clarsimp apply (erule disjE) apply simp apply (thin_tac "P \<longrightarrow> Q" for P Q) apply (subgoal_tac "is_chunk n' cap p p'") prefer 2 apply (clarsimp simp: is_chunk_def) apply (simp add: n'_trancl_eq n'_rtrancl_eq split: if_split_asm) apply (erule disjE) apply (erule_tac x=parent in allE) apply clarsimp apply (erule impE, fastforce) apply (clarsimp simp: parent) apply (simp add: site' new_site_def) apply (erule sameRegionAs_trans, rule same_region) apply (clarsimp simp add: parent) apply (simp add: site' new_site_def) apply (rule same_region) apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply simp apply (rule conjI) apply clarsimp apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply (rule conjI, clarsimp) apply (drule (1) trancl_trans, erule loopE) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply clarsimp apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply (rule conjI, clarsimp) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply simp apply (thin_tac "P \<longrightarrow> Q" for P Q) apply (subgoal_tac "is_chunk n' cap' p' p") prefer 2 apply (clarsimp simp: is_chunk_def) apply (simp add: n'_trancl_eq n'_rtrancl_eq split: if_split_asm) apply (erule disjE) apply (erule_tac x=parent in allE) apply clarsimp apply (erule impE, fastforce) apply (clarsimp simp: parent) apply (simp add: site' new_site_def) apply (erule sameRegionAs_trans, rule same_region) apply (clarsimp simp add: parent) apply (simp add: site' new_site_def) apply (rule same_region) apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply simp apply (rule conjI) apply clarsimp apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply (rule conjI, clarsimp) apply (drule (1) trancl_trans, erule loopE) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply clarsimp apply (rule conjI) apply clarsimp apply (drule (1) trancl_trans, erule loopE) apply (rule conjI, clarsimp) apply clarsimp apply (drule (1) trancl_trans, erule loopE) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. mdb_chunked n' proof (prove)
using this:
mdb_chunked m
untyped_mdb' m
untyped_inc' m

goal (1 subgoal):
 1. mdb_chunked n' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; n' p = Some (CTE cap n); n' p' = Some (CTE cap' n'a); global.sameRegionAs cap cap'; p \<noteq> p'\<rbrakk> \<Longrightarrow> (n' \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n' \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n' \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (n' \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap n cap' n'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; if p = site then cap = c' \<and> m p = Some (CTE capability.NullCap site_node) else \<exists>node'. m p = Some (CTE cap node'); if p' = site then cap' = c' \<and> m p' = Some (CTE capability.NullCap site_node) else \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (n' \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n' \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n' \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (n' \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; if p = site then cap = c' \<and> m p = Some (CTE capability.NullCap site_node) else \<exists>node'. m p = Some (CTE cap node'); if p' = site then cap' = c' \<and> m p' = Some (CTE capability.NullCap site_node) else \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> ((if p = site then m \<turnstile> parent \<leadsto>\<^sup>+ p' else if m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent then m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> p' = site else m \<turnstile> p \<leadsto>\<^sup>+ p') \<or> (if p' = site then m \<turnstile> parent \<leadsto>\<^sup>+ p else if m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent then m \<turnstile> p' \<leadsto>\<^sup>+ p \<or> p = site else m \<turnstile> p' \<leadsto>\<^sup>+ p)) \<and> ((if p = site then m \<turnstile> parent \<leadsto>\<^sup>+ p' else if m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent then m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> p' = site else m \<turnstile> p \<leadsto>\<^sup>+ p') \<longrightarrow> is_chunk n' cap p p') \<and> ((if p' = site then m \<turnstile> parent \<leadsto>\<^sup>+ p else if m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent then m \<turnstile> p' \<leadsto>\<^sup>+ p \<or> p = site else m \<turnstile> p' \<leadsto>\<^sup>+ p) \<longrightarrow> is_chunk n' cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap'. \<lbrakk>\<exists>node'. m p' = Some (CTE cap' node'); \<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; p = site; m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p' \<or> parent = p' \<or> isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; parent = p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 3. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 4. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (8 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'\<rbrakk> \<Longrightarrow> capClass c' = PhysicalClass \<or> capClass cap' = PhysicalClass
 2. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'\<rbrakk> \<Longrightarrow> capAligned c'
 3. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'\<rbrakk> \<Longrightarrow> capAligned cap'
 4. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'; capRange cap' \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 5. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; parent = p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 6. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 7. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 8. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (7 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'\<rbrakk> \<Longrightarrow> capAligned c'
 2. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'\<rbrakk> \<Longrightarrow> capAligned cap'
 3. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'; capRange cap' \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 4. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; parent = p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 5. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 6. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 7. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (6 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'\<rbrakk> \<Longrightarrow> capAligned cap'
 2. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'; capRange cap' \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 3. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; parent = p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 4. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 5. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 6. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (6 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'\<rbrakk> \<Longrightarrow> valid_cap' cap' (?s80 p' cap' node')
 2. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'; capRange cap' \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 3. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; parent = p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 4. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 5. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 6. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; m \<turnstile> parent \<rightarrow> p'; capRange cap' \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; parent = p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 3. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 4. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; parent = p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 3. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap' \<and> untypedRange parent_cap \<subseteq> untypedRange cap' \<and> global.sameRegionAs cap' parent_cap \<and> m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p') \<and> is_chunk n' cap' p' site) \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' c' site p'))
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' site \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site)
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' = parent\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' site \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site)
 2. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' \<noteq> parent\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' site \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site)
 3. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' \<noteq> parent\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' site \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site)
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' \<noteq> parent; \<forall>p'a cap. (\<exists>n. m p' = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p'a = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p' \<noteq> p'a \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ p'a \<or> m \<turnstile> p'a \<leadsto>\<^sup>+ p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p'a \<longrightarrow> is_chunk m cap p' p'a) \<and> (m \<turnstile> p'a \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap' p'a p'))\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' site \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site)
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' \<noteq> parent; \<forall>cap. (\<exists>n. m p' = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m parent = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p' parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap' parent p'))\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' site \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site)
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' \<noteq> parent; \<forall>cap. (\<exists>n. m p' = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m parent = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p' parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap' parent p')); global.sameRegionAs cap' c'\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' site \<and> (p' = parent \<longrightarrow> is_chunk n' cap' parent site)
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' \<noteq> parent; global.sameRegionAs cap' c'; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap'')); m \<turnstile> p'' \<leadsto>\<^sup>* parent; p'' \<noteq> site; m \<turnstile> p' \<leadsto>\<^sup>+ p''\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' \<noteq> parent; global.sameRegionAs cap' c'; m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap'')); m \<turnstile> p'' \<leadsto>\<^sup>* parent; p'' \<noteq> site; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs c' cap'; site \<noteq> p'; m site = Some (CTE capability.NullCap site_node); m p' = Some (CTE cap' node'); global.sameRegionAs parent_cap cap'; isUntypedCap cap'; untypedRange parent_cap \<subseteq> untypedRange cap'; global.sameRegionAs cap' parent_cap; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; p' \<noteq> parent; global.sameRegionAs cap' c'; m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap'')); m \<turnstile> p'' \<leadsto>\<^sup>* parent; p'' \<noteq> site; m \<turnstile> p' \<leadsto>\<^sup>+ p''; global.sameRegionAs cap' cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; p' = site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); \<forall>p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); \<forall>cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m parent = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' parent p))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); \<forall>cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m parent = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' parent p)); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p = parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; parent_cap = cap; m site = Some (CTE capability.NullCap site_node); isUntypedCap cap; p = parent\<rbrakk> \<Longrightarrow> is_chunk n' cap parent site
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; n' \<turnstile> parent \<leadsto>\<^sup>+ p''; n' \<turnstile> p'' \<leadsto>\<^sup>* site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; n' \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' = site \<or> p'' \<noteq> site \<and> n' \<turnstile> p'' \<leadsto>\<^sup>+ site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; n' \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' = site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; n' \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site \<and> n' \<turnstile> p'' \<leadsto>\<^sup>+ site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; n' \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site \<and> n' \<turnstile> p'' \<leadsto>\<^sup>+ site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; n' \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; n' \<turnstile> p'' \<leadsto>\<^sup>+ site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; p'' \<noteq> site; n' \<turnstile> p'' \<leadsto>\<^sup>+ site; \<exists>z. n' \<turnstile> parent \<leadsto> z \<and> n' \<turnstile> z \<leadsto>\<^sup>* p''\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; p'' \<noteq> site; n' \<turnstile> p'' \<leadsto>\<^sup>+ site; n' \<turnstile> site \<leadsto>\<^sup>* p''\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap c'; m site = Some (CTE capability.NullCap site_node); isUntypedCap parent_cap; p'' \<noteq> site; n' \<turnstile> p'' \<leadsto>\<^sup>+ site; n' \<turnstile> site \<leadsto>\<^sup>+ site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> p \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> (p = parent \<longrightarrow> is_chunk n' cap parent site) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>\<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p m); untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; \<forall>p' c. (\<exists>n. m parent = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' parent m)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; \<forall>p' c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange parent_cap \<noteq> {} \<longrightarrow> p' \<in> descendants_of' parent m\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; \<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange parent_cap \<noteq> {} \<longrightarrow> p \<in> descendants_of' parent m\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange cap \<inter> untypedRange parent_cap \<noteq> {} \<longrightarrow> m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> capRange cap \<inter> untypedRange parent_cap \<noteq> {}
 2. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (6 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> capAligned cap
 2. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> capAligned c'
 3. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange c' \<inter> capRange cap \<noteq> {}\<rbrakk> \<Longrightarrow> capRange cap \<inter> untypedRange parent_cap \<noteq> {}
 4. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 6. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> capAligned c'
 2. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange c' \<inter> capRange cap \<noteq> {}\<rbrakk> \<Longrightarrow> capRange cap \<inter> untypedRange parent_cap \<noteq> {}
 3. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange c' \<inter> capRange cap \<noteq> {}\<rbrakk> \<Longrightarrow> capRange cap \<inter> untypedRange parent_cap \<noteq> {}
 2. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange c' \<inter> capRange cap \<noteq> {}; capRange c' \<subseteq> untypedRange parent_cap\<rbrakk> \<Longrightarrow> capRange cap \<inter> untypedRange parent_cap \<noteq> {}
 2. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange cap \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange cap \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> capClass cap = PhysicalClass \<or> capClass c' = PhysicalClass
 2. \<And>p cap node'. \<lbrakk>untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange cap \<inter> capRange c' = {}; capRange cap \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; \<not> isUntypedCap cap; capRange cap \<inter> capRange c' = {}; capRange cap \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> global.sameRegionAs cap parent_cap
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; m p = Some (CTE (capability.UntypedCap da v0a v1a fa) node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE (capability.UntypedCap d v0 v1 f) parent_node); p \<noteq> parent; {v0..v0 + 2 ^ v1 - 1} \<subseteq> {v0a..v0a + 2 ^ v1a - 1}; parent_cap = capability.UntypedCap d v0 v1 f\<rbrakk> \<Longrightarrow> global.sameRegionAs (capability.UntypedCap da v0a v1a fa) (capability.UntypedCap d v0 v1 f)
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>parent_cap = capability.UntypedCap d v0 v1 f; untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; m p = Some (CTE (capability.UntypedCap da v0a v1a fa) node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE (capability.UntypedCap d v0 v1 f) parent_node); p \<noteq> parent\<rbrakk> \<Longrightarrow> v0 \<le> v0 + 2 ^ v1 - 1
 2. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; m p = Some (CTE (capability.UntypedCap da v0a v1a fa) node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE (capability.UntypedCap d v0 v1 f) parent_node); p \<noteq> parent; v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1; parent_cap = capability.UntypedCap d v0 v1 f\<rbrakk> \<Longrightarrow> global.sameRegionAs (capability.UntypedCap da v0a v1a fa) (capability.UntypedCap d v0 v1 f)
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>parent_cap = capability.UntypedCap d v0 v1 f; untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; p \<noteq> parent; valid_cap' (capability.UntypedCap da v0a v1a fa) s; valid_cap' capability.NullCap s; valid_cap' (capability.UntypedCap d v0 v1 f) s\<rbrakk> \<Longrightarrow> v0 \<le> v0 + 2 ^ v1 - 1
 2. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; m p = Some (CTE (capability.UntypedCap da v0a v1a fa) node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE (capability.UntypedCap d v0 v1 f) parent_node); p \<noteq> parent; v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1; parent_cap = capability.UntypedCap d v0 v1 f\<rbrakk> \<Longrightarrow> global.sameRegionAs (capability.UntypedCap da v0a v1a fa) (capability.UntypedCap d v0 v1 f)
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>parent_cap = capability.UntypedCap d v0 v1 f; untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; p \<noteq> parent; capAligned (capability.UntypedCap da v0a v1a fa); capAligned capability.NullCap; capAligned (capability.UntypedCap d v0 v1 f)\<rbrakk> \<Longrightarrow> v0 \<le> v0 + 2 ^ v1 - 1
 2. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; m p = Some (CTE (capability.UntypedCap da v0a v1a fa) node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE (capability.UntypedCap d v0 v1 f) parent_node); p \<noteq> parent; v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1; parent_cap = capability.UntypedCap d v0 v1 f\<rbrakk> \<Longrightarrow> global.sameRegionAs (capability.UntypedCap da v0a v1a fa) (capability.UntypedCap d v0 v1 f)
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p d da v0 v0a v1 v1a f fa. \<lbrakk>parent_cap = capability.UntypedCap d v0 v1 f; untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; p \<noteq> parent; is_aligned v0a v1a; v1a < word_bits; is_aligned v0 v1; v1 < word_bits\<rbrakk> \<Longrightarrow> v0 \<le> v0 + 2 ^ v1 - 1
 2. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; m p = Some (CTE (capability.UntypedCap da v0a v1a fa) node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE (capability.UntypedCap d v0 v1 f) parent_node); p \<noteq> parent; v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1; parent_cap = capability.UntypedCap d v0 v1 f\<rbrakk> \<Longrightarrow> global.sameRegionAs (capability.UntypedCap da v0a v1a fa) (capability.UntypedCap d v0 v1 f)
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; m p = Some (CTE (capability.UntypedCap da v0a v1a fa) node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE (capability.UntypedCap d v0 v1 f) parent_node); p \<noteq> parent; v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1; parent_cap = capability.UntypedCap d v0 v1 f\<rbrakk> \<Longrightarrow> global.sameRegionAs (capability.UntypedCap da v0a v1a fa) (capability.UntypedCap d v0 v1 f)
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; m p = Some (CTE (capability.UntypedCap da v0a v1a fa) node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE (capability.UntypedCap d v0 v1 f) parent_node); p \<noteq> parent; v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1; parent_cap = capability.UntypedCap d v0 v1 f\<rbrakk> \<Longrightarrow> v0 \<le> v0 + 2 ^ v1 - 1 \<and> (v0 \<le> v0 + 2 ^ v1 - 1 \<longrightarrow> v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1)
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; p \<noteq> parent; v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1; parent_cap = capability.UntypedCap d v0 v1 f; valid_cap' (capability.UntypedCap da v0a v1a fa) s; valid_cap' capability.NullCap s; valid_cap' (capability.UntypedCap d v0 v1 f) s\<rbrakk> \<Longrightarrow> v0 \<le> v0 + 2 ^ v1 - 1 \<and> (v0 \<le> v0 + 2 ^ v1 - 1 \<longrightarrow> v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1)
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p node' d da v0 v0a v1 v1a f fa. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs (capability.UntypedCap da v0a v1a fa) c'; p \<noteq> site; p \<noteq> parent; v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1; parent_cap = capability.UntypedCap d v0 v1 f; capAligned (capability.UntypedCap da v0a v1a fa); capAligned capability.NullCap; capAligned (capability.UntypedCap d v0 v1 f)\<rbrakk> \<Longrightarrow> v0 \<le> v0 + 2 ^ v1 - 1 \<and> (v0 \<le> v0 + 2 ^ v1 - 1 \<longrightarrow> v0a \<le> v0 \<and> v0 + 2 ^ v1 - 1 \<le> v0a + 2 ^ v1a - 1)
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap p site
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap p site
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> parent \<leadsto>\<^sup>+ p; is_chunk m parent_cap parent p\<rbrakk> \<Longrightarrow> is_chunk n' c' site p
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap p site
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap p site
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m cap p parent; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap p site
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; n' \<turnstile> p \<leadsto>\<^sup>+ p''; n' \<turnstile> p'' \<leadsto>\<^sup>* site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (6 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; p'' = site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 6. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node' p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; global.sameRegionAs cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node' p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; global.sameRegionAs cap cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* parent \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* site\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> is_chunk n' c' site p) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> is_chunk n' c' site p)
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> is_chunk n' c' site p
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> is_chunk n' c' site p
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ parent; is_chunk m cap p parent\<rbrakk> \<Longrightarrow> is_chunk n' cap p site \<and> is_chunk n' c' site p
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> is_chunk n' c' site p
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent; is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> is_chunk n' c' site p
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; is_chunk m parent_cap parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> is_chunk n' c' site p
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; n' \<turnstile> site \<leadsto>\<^sup>+ p''; n' \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs c' cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs c' cap''
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs c' cap''
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs c' cap''
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; m \<turnstile> p \<rightarrow> parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs c' cap''
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs c' cap''
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange cap = {}) \<and> (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {} \<or> parent = p)\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {})\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}); \<not> m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {})\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> parent \<rightarrow> p
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {})\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> parent \<rightarrow> p
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}); \<not> m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}; m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> False
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}); \<not> m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}; capRange cap \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}); \<not> m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}; capRange cap \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> capClass cap = PhysicalClass \<or> capClass c' = PhysicalClass
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}; capRange cap \<inter> capRange c' = {}; capRange cap \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> False
 3. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}); \<not> m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}; capRange cap \<inter> capRange c' = {}; capRange cap \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> False
 2. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}); \<not> m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subseteq> untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {}); \<not> m \<turnstile> parent \<rightarrow> p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; untypedRange parent_cap \<subset> untypedRange cap \<or> untypedRange parent_cap = untypedRange cap; m \<turnstile> parent \<leadsto>\<^sup>+ p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; m \<turnstile> parent \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; \<not> m \<turnstile> parent \<rightarrow> p; untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}; \<not> untypedRange cap \<subset> untypedRange parent_cap; untypedRange parent_cap = untypedRange cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange cap = {}\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subseteq> untypedRange cap; (untypedRange parent_cap \<subseteq> untypedRange cap \<or> untypedRange cap \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange cap = {}) \<and> (untypedRange parent_cap \<subset> untypedRange cap \<longrightarrow> parent \<in> descendants_of' p m \<and> untypedRange parent_cap \<inter> usableUntypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> p \<in> descendants_of' parent m \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}) \<and> (untypedRange parent_cap = untypedRange cap \<longrightarrow> p \<in> descendants_of' parent m \<and> usableUntypedRange parent_cap = {} \<or> parent \<in> descendants_of' p m \<and> usableUntypedRange cap = {} \<or> parent = p)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap \<and> untypedRange parent_cap \<noteq> untypedRange cap; (untypedRange cap \<subset> untypedRange parent_cap \<or> untypedRange cap = untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange cap = {}) \<and> (untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {})\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p; untypedRange cap \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange cap = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<inter> untypedRange cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap; untypedRange cap \<inter> usableUntypedRange parent_cap = {}; capRange cap \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange cap = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<inter> untypedRange cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap; untypedRange cap \<inter> usableUntypedRange parent_cap = {}; capRange cap \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> capClass cap = PhysicalClass \<or> capClass c' = PhysicalClass
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap; untypedRange cap \<inter> usableUntypedRange parent_cap = {}; capRange cap \<inter> capRange c' = {}; capRange cap \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange cap = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 4. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<inter> untypedRange cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 5. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<inter> untypedRange cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> untypedRange parent_cap \<subset> untypedRange cap; untypedRange parent_cap \<noteq> untypedRange cap; untypedRange cap \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange cap \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<inter> untypedRange cap = {}; capRange c' \<subseteq> capRange parent_cap; isUntypedCap parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> capRange parent_cap \<subset> capRange cap; capRange parent_cap \<noteq> capRange cap; capRange cap \<subset> capRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> capRange cap \<inter> usableUntypedRange parent_cap = {}; capRange parent_cap \<inter> capRange cap = {}; capRange c' \<subseteq> capRange parent_cap; isUntypedCap parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap c'; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> capRange parent_cap \<subset> capRange cap; capRange parent_cap \<noteq> capRange cap; capRange cap \<subset> capRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> capRange cap \<inter> usableUntypedRange parent_cap = {}; capRange parent_cap \<inter> capRange cap = {}; isUntypedCap parent_cap; capRange c' \<inter> capRange cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> capRange parent_cap \<subset> capRange cap; capRange parent_cap \<noteq> capRange cap; capRange cap \<subset> capRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> capRange cap \<inter> usableUntypedRange parent_cap = {}; capRange parent_cap \<inter> capRange cap = {}; isUntypedCap parent_cap; capRange c' \<inter> capRange cap = {}\<rbrakk> \<Longrightarrow> capClass cap = PhysicalClass \<or> capClass c' = PhysicalClass
 2. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> capRange parent_cap \<subset> capRange cap; capRange parent_cap \<noteq> capRange cap; capRange cap \<subset> capRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> capRange cap \<inter> usableUntypedRange parent_cap = {}; capRange parent_cap \<inter> capRange cap = {}; isUntypedCap parent_cap; capRange c' \<inter> capRange cap = {}; capRange cap \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 3. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; p \<noteq> site; m p = Some (CTE cap node'); m site = Some (CTE capability.NullCap site_node); global.sameRegionAs cap parent_cap \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> m \<turnstile> parent \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk m cap p parent) \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m parent_cap parent p); m parent = Some (CTE parent_cap parent_node); p \<noteq> parent; isUntypedCap cap; \<not> capRange parent_cap \<subset> capRange cap; capRange parent_cap \<noteq> capRange cap; capRange cap \<subset> capRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> capRange cap \<inter> usableUntypedRange parent_cap = {}; capRange parent_cap \<inter> capRange cap = {}; isUntypedCap parent_cap; capRange c' \<inter> capRange cap = {}; capRange cap \<inter> capRange c' \<noteq> {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p site \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p)) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' c' site p))
 2. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); \<exists>node'. m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk n' cap p p'
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk n' cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; n' \<turnstile> p \<leadsto>\<^sup>+ p''; n' \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (7 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (8 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; p = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 8. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (8 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m parent = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; p = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 8. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (8 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> parent \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> parent \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m parent = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; p = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 8. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (8 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> parent \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent; \<exists>cap''. (\<exists>n''. m parent = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; p = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 8. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (8 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> parent \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent; global.sameRegionAs cap parent_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; p = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 8. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (8 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> parent \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent; global.sameRegionAs cap parent_cap\<rbrakk> \<Longrightarrow> global.sameRegionAs cap c'
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; p = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 8. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (7 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p'; p = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (7 subgoals):
 1. \<And>p' cap' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap cap'; parent \<noteq> p'; p' \<noteq> site; m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (7 subgoals):
 1. \<And>p' cap' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs parent_cap cap'; parent \<noteq> p'; p' \<noteq> site; m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> global.sameRegionAs parent_cap c'
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (6 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (6 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'; m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (6 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (6 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'; m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ parent \<or> p = parent; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'; m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'; m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p'; m \<turnstile> p \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> is_chunk n' cap p p' \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (4 subgoals):
 1. \<And>p cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> parent; p \<noteq> site; m p = Some (CTE cap node'); m parent = Some (CTE cap' node'a); is_chunk m cap p parent; is_chunk n' cap p parent; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk n' cap' parent p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ parent; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; parent \<noteq> p'; p' \<noteq> site; m parent = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap parent p'; m \<turnstile> parent \<leadsto>\<^sup>+ p'; is_chunk n' cap parent p'; m \<turnstile> p' \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' parent
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap p p'; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk n' cap p p'; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p)) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' p' p))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> is_chunk n' cap' p' p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; n' \<turnstile> p' \<leadsto>\<^sup>+ p''; n' \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (6 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (7 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; p' = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (7 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m parent = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; p' = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (7 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> parent \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent; m \<turnstile> parent \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m parent = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; p' = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (7 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> parent \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent; \<exists>cap''. (\<exists>n''. m parent = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; p' = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (7 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> parent \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent; global.sameRegionAs cap' parent_cap\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; p' = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (7 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> parent \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent; global.sameRegionAs cap' parent_cap\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' c'
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; p' = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 7. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (6 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' = site; m \<turnstile> parent \<leadsto>\<^sup>+ p; p' = parent\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (6 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap parent_cap; p \<noteq> parent; p \<noteq> site; m p = Some (CTE cap node'); \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' site = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (6 subgoals):
 1. \<And>p cap node'. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap parent_cap; p \<noteq> parent; p \<noteq> site; m p = Some (CTE cap node'); \<forall>p''. m \<turnstile> parent \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs parent_cap cap''); m \<turnstile> parent \<leadsto>\<^sup>+ p\<rbrakk> \<Longrightarrow> global.sameRegionAs parent_cap c'
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p; m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ parent \<or> p' = parent; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p; m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p'' \<leadsto>\<^sup>* parent; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p' \<leadsto>\<^sup>+ p''; p'' \<noteq> site; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; (p'', parent) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; if p'' = site then \<exists>node'. n' site = Some (CTE c' node') else \<exists>node'. n' p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n' p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p) \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> is_chunk n' cap' p' p)) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk n' cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> is_chunk n' cap p parent \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (3 subgoals):
 1. \<And>p cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> parent; p \<noteq> site; m p = Some (CTE cap node'); m parent = Some (CTE cap' node'a); is_chunk m cap' parent p; m \<turnstile> parent \<leadsto>\<^sup>+ p; is_chunk n' cap' parent p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> is_chunk n' cap p parent
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p'
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent\<rbrakk> \<Longrightarrow> (p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ parent; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk n' cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))) \<and> ((p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p') \<and> is_chunk n' cap' p' parent) \<and> p' \<noteq> parent \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p' \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap parent p'))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') proof (prove)
goal (2 subgoals):
 1. \<And>p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; parent \<noteq> p'; p' \<noteq> site; m parent = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; is_chunk n' cap' p' parent; m \<turnstile> parent \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk n' cap parent p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p\<rbrakk> \<Longrightarrow> (p, parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') \<and> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; m \<turnstile> p' \<leadsto>\<^sup>+ parent; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk n' cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (p' = parent \<longrightarrow> m \<turnstile> parent \<leadsto>\<^sup>+ p \<and> (m \<turnstile> parent \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n' cap' parent p)) \<and> ((p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent\<rbrakk> \<Longrightarrow> (p', parent) \<notin> (mdb_next_rel m)\<^sup>+ \<and> p' \<noteq> parent \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n' cap p p' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>untyped_mdb' m; untyped_inc' m; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> site; p' \<noteq> site; m p = Some (CTE cap node'); m p' = Some (CTE cap' node'a); is_chunk m cap' p' p; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk n' cap' p' p; (p, parent) \<notin> (mdb_next_rel m)\<^sup>+; p \<noteq> parent; (p', parent) \<notin> (mdb_next_rel m)\<^sup>+; p' \<noteq> parent; m \<turnstile> p \<leadsto>\<^sup>+ p'\<rbrakk> \<Longrightarrow> is_chunk n' cap p p' proof (prove)
goal:
No subgoals!